CVE-2026-12569— Remote Code Execution (RCE) vulnerability in Windchill PDMlink
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 19
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| PTC | FlexPLM | ≤ 11.0 M030 | affected |
11.1 M020 | affected | ||
11.2.1.0 | affected | ||
12.0.0.0 | affected | ||
12.0.2.0 | affected | ||
12.1.2.0 | affected | ||
12.1.3.0 | affected | ||
13.0.2.0 | affected | ||
| … +1 more rows | |||
| PTC | Windchill PDMLink | ≤ 11.0 M030 | affected |
11.1 M020 | affected | ||
11.2.1.0 | affected | ||
12.0.2.0 | affected | ||
12.1.2.0 | affected | ||
13.0.2.0 | affected | ||
13.1.0.0 | affected | ||
13.1.1.0 | affected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12569
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
Source: NVD (National Vulnerability Database)
Vulnerability Description
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
输入验证不恰当
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PTC | Windchill PDMLink | 0 ~ 11.0 M030 | - | |
| PTC | FlexPLM | 0 ~ 11.0 M030 | - |
II. Public POCs for CVE-2026-12569
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12569
请登录查看更多情报信息。
News Coverage for CVE-2026-12569 (1)
IV. Related Vulnerabilities
Same vendor: PTC
- CVE-2026-4681
Critical Remote Code Execution vulnerability reported in Win - CVE-2024-6098
PTC Kepware ThingWorx Kepware Server Allocation of Resources - CVE-2024-6071
PTC Creo Elements/Direct License Server Missing Authorizatio - CVE-2024-3951
Cross-site Scripting in PTC Codebeamer - CVE-2023-29447
Insufficiently Protected Credentials in PTC's Kepware KEPSer
Same weakness: CWE-20
- CVE-2026-48774
ProxySQL MCP run_sql_readonly executes side-effecting MySQL - CVE-2026-21768
HCL Verse for Android is susceptible to an injection vulnera - CVE-2026-39998
Apache APISIX: Identity Injection via forward-auth Plugin Mi - CVE-2025-58175
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerabi - CVE-2026-50196
Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name
V. Comments for CVE-2026-12569
No comments yet