PTC Windchill PDMLink/FlexPLM up to 13.1.3.0 input validation

Summaryinfo

A vulnerability, which was classified as critical, was found in PTC Windchill PDMLink and FlexPLM up to 13.1.3.0. This vulnerability affects unknown code. Such manipulation leads to input validation. This vulnerability is uniquely identified as CVE-2026-12569. The attack can be launched remotely. Moreover, an exploit is present. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in PTC Windchill PDMLink and FlexPLM up to 13.1.3.0. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

The advisory is available at ptc.com. This vulnerability is handled as CVE-2026-12569 since 06/18/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but an exploit is available.

It is declared as attacked. This issue was added on 06/25/2026 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 06/28/2026:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BO

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1991). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• PTC FlexPLM
• PTC Windchill

Productinfo

Vendor

• PTC

Name

• FlexPLM
• Windchill PDMLink

Version

• 11.0 M030
• 11.1 M020
• 11.2.0
• 11.2.1.0
• 12.0.0
• 12.0.1
• 12.0.2.0
• 12.1.0
• 12.1.1
• 12.1.2.0
• 13.0.0
• 13.0.1
• 13.0.2.0
• 13.1.0
• 13.1.1
• 13.1.1.0
• 13.1.2
• 13.1.2.0
• 13.1.3.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion