CVE-2026-12569 — PTC Windchill and FlexPLM Improper Input Validation Vulnerability
PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.
- CVSS
- 9.8 (Critical)
- KEV status
- CISA KEV — Listed
- First seen (CISA KEV)
- Recommended change window
- Emergency change — Windchill/FlexPLM are engineering data crown jewels; patch within one weekend maintenance window and audit for unexpected admin sessions.
- Vendor advisory
- https://www.ptc.com/en/support/article/CS473270
- Affected products
- PTC Windchill and FlexPLM
Why this one matters to a CAB
Windchill and FlexPLM are PTC’s product-lifecycle-management platforms. They hold engineering CAD, bill-of-materials, and supply-chain vendor data — the crown jewels for any manufacturing, aerospace, or medical-device business. An unauthenticated RCE in the PLM tier is an intellectual-property incident, not just an IT incident.
Defender’s angle
- IP exfiltration monitoring: enable network egress monitoring from the Windchill / FlexPLM tier before the patch window. Baseline the normal egress and alert on any deviation.
- Vendor account exposure: PLM tiers often federate with supplier accounts. Confirm supplier federation is scoped and audited; the CAB should ask for the supplier account list as part of the change record.
- CAD file hash: capture a manifest of key CAD file hashes before the change window. Post-incident forensics benefits enormously from a “was this file modified” question you can answer in minutes.
What to bring to CAB
A change record co-signed by the engineering data owner (typically the VP Engineering or a delegated PLM steward), not just IT. IP loss risk lives on their P&L.
Sources
This page summarizes publicly available information from CISA KEV, NVD, and the listed vendor advisory. Change Risk Intel does not publish exploit walkthroughs. Verify with your vendor before scheduling any change window.