CVE-2026-12569: PTC Windchill and FlexPLM Improper Input Validation Vulnerability

PTC Windchill and FlexPLM contain an improper input validation vulnerability that permits an unauthenticated remote attacker to execute arbitrary code by sending a malicious request to the network. The flaw affects product lifecycle management deployments and requires attention from teams responsible for these systems.

How it works

The weakness is tracked under CWE-20 and CWE-502. An attacker supplies input that is not properly validated before processing, which can result in execution of arbitrary code on the server.

Am I affected? How to find it in your systems

PTC Windchill and FlexPLM are deployed in manufacturing and engineering environments for product data management. Locate all instances through asset inventories and configuration management databases.

• Compare installed releases and configurations against the vendor advisory to determine exposure.
• Assess whether the services are reachable from untrusted networks.
• Review application and network logs for anomalous inbound requests that target the affected endpoints.

How to remediate

Apply mitigations in accordance with vendor instructions while complying with CISA BOD 26-04 guidance on prioritizing security updates based on risk.

• Install the vendor-supplied update for the affected products.
• Apply the same process to any cloud-hosted instances covered by BOD 26-04.
• Document completion of required actions for each asset.

If you can't patch immediately

Until updates can be applied, limit exposure by evaluating internet accessibility of each instance.

• Restrict network access through segmentation or access controls.
• Discontinue use of the product if no mitigations are available.
• Follow CISA forensics triage requirements for any suspected incidents.

If your data may have been exposed

Actively exploited vulnerabilities of this class can result in breaches. Run a free exposure scan of email addresses to check against known breach data.