Description
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
Metrics
CVSS 3.1 9.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| PTC | Windchill PDMLink | <= 11.0 M030; 11.1 M020; 11.2.1.0; 12.0.2.0; 12.1.2.0; 13.0.2.0; 13.1.0.0; 13.1.1.0; 13.1.2.0; 13.1.3.0 |
| PTC | FlexPLM | <= 11.0 M030; 11.1 M020; 11.2.1.0; 12.0.0.0; 12.0.2.0; 12.1.2.0; 12.1.3.0; 13.0.2.0; 13.0.3.0 |
References
- https://www.ptc.com/en/support/article/CS473270Permissions Required
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569US Government Resource
Timeline
- Published
- Jun 18, 2026
- Last modified
- Aug 1, 2026
- Added to CISA KEV
- Jun 25, 2026
- NVD status
- Analyzed