Evidence dossier

CVE-2026-12569

Remote Code Execution (RCE) vulnerability in Windchill PDMlink

65.5–81.7Priority evidence range

As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

State: PUBLISHED
Published: Jun 18, 2026
Updated: Jun 30, 2026
Evidence coverage: 85%

CISA KEVCatalog member

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

FIRST EPSS1.25%

2026-07-18 · v2026.06.15 · percentile 66.0%

Source stateNo scored conflict

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

CISA-ADPindependent enrichment

container

CISA ADP Vulnrichment

Jul 19, 2026Original evidence ↗

PTCoriginal assertion

container

Remote Code Execution (RCE) vulnerability in Windchill PDMlink

Jul 19, 2026Original evidence ↗

CISA KEVoriginal assertion

observed_exploitation

PTC Windchill and FlexPLM Improper Input Validation Vulnerability

Jul 19, 2026Original evidence ↗

FIRST EPSSoriginal assertion

model_probability

Probability 0.012470000000; percentile 0.659900000000

Jul 19, 2026Original evidence ↗

Applicability

Cited product scope

Trace impact →

PTCFlexPLM

[{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "11.0 M030"}, {"status": "affected", "version": "11.1 M020"}, {"status": "affected", "version": "11.2.1.0"}, {"status": "affected", "version": "12.0.0.0"}, {"status": "affected", "version": "12.0.2.0"}, {"status": "affected", "version": "12.1.2.0"}, {"status": "affected", "version": "12.1.3.0"}, {"status": "affected", "version": "13.0.2.0"}, {"status": "affected", "version": "13.0.3.0"}]

unknown

PTCWindchill PDMLink

[{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "11.0 M030"}, {"status": "affected", "version": "11.1 M020"}, {"status": "affected", "version": "11.2.1.0"}, {"status": "affected", "version": "12.0.2.0"}, {"status": "affected", "version": "12.1.2.0"}, {"status": "affected", "version": "13.0.2.0"}, {"status": "affected", "version": "13.1.0.0"}, {"status": "affected", "version": "13.1.1.0"}, {"status": "affected", "version": "13.1.2.0"}, {"status": "affected", "version": "13.1.3.0"}]

unknown