CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue
Summary: CISA added CVE-2026-12569, a critical remote code execution flaw with a CVSS score of 9.3 in PTC Windchill PDMlink and PTC FlexPLM, to its Known Exploited Vulnerabilities catalog on Thursday, citing evidence of active exploitation. PTC said the flaw involves deserialization of untrusted data, and as of June 25 confirmed continued reports of heightened threat activity, with unknown attackers deploying JSP web shells against susceptible systems.
Key Takeaway: This is the first PTC product ever added to CISA's KEV catalog, and attackers are already using the flaw to plant web shells with a recognizable naming pattern under /Windchill/login/ - meaning any unpatched Windchill or FlexPLM instance is a live target, not a theoretical one.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-12569
- Related
- CVE-2026-12569: PTC Windchill and FlexPLM Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Jun 25, 2026