Attackers are actively exploiting a critical remote code execution flaw in PTC’s Windchill product lifecycle management platform, deploying persistent web shells across instances used by defence contractors, aerospace firms, and automotive manufacturers. CVE-2026-12569, added to CISA’s Known Exploited Vulnerabilities catalog on June 25, carries a CVSS score of 9.3 and allows unauthenticated attackers to execute arbitrary code via specially crafted network requests targeting the application’s deserialisation logic.
Context
PTC Windchill and its supply chain companion FlexPLM are used by over 1.5 million people worldwide to manage product data, design files, bills of materials, and supply chain workflows. Customers include BMW, Lockheed Martin, Boeing, and NVIDIA. The software underpins product development operations across defence, aerospace, automotive, medical devices, electronics, and industrial machinery.
PTC disclosed the vulnerability on June 17 and released patches the same day, publishing indicators of compromise on June 18. Despite that timeline, active exploitation was confirmed publicly on June 26, nine days after the patch was available. CISA set a federal agency remediation deadline of June 28, which has now passed.
This marks the first time any PTC product has appeared in CISA’s KEV catalog.
How Attackers Are Exploiting It
The vulnerability is a deserialisation flaw: Windchill accepts a serialised object from the network and reconstructs it without verifying the content is safe. The rebuild step triggers code execution. No authentication is required to send the malicious request.
Attackers are using the foothold to install persistent JSP web shells. PTC and security researchers have identified a consistent naming pattern: web shells are placed at /Windchill/login/[0-9a-f]{16}.jsp, using 16 lowercase hexadecimal characters as the filename. The shells provide persistent remote command execution and data exfiltration capability from inside the network perimeter.
All CPS versions and Windchill and FlexPLM releases prior to 11.0 M030 are affected.
What This Means for Affected Sectors
PLM systems occupy a privileged position in manufacturing environments. They hold design IP, supply chain data, bills of materials, and in many cases interface with OT networks and engineering workstations for configuration management. A persistent web shell in a Windchill instance gives an attacker a stable command-and-control foothold with potential pathways into adjacent systems including ERP platforms, engineering networks, and product design repositories.
The affected user base, defence primes, aerospace integrators, automotive OEMs, crosses most of the sectors that nation-state actors consistently prioritise for economic and industrial espionage. No attribution has been made public. The combination of speed to exploitation after patch release, the profile of the user base, and the value of accessible IP makes this worth treating as a targeted campaign unless evidence emerges otherwise.
For organisations in defence or aerospace supply chains, a Windchill compromise could expose controlled technical data or export-controlled designs. Incident response for any compromised instance should include a review of what data was accessible from that host.
Recommended Actions
- Patch immediately: Update all Windchill PDMlink and FlexPLM instances to version 11.0 M030 or later. This applies regardless of internet exposure; internal instances are also at risk.
- Hunt for web shells: Search server logs for any POST request to
/Windchill/login/[0-9a-f]{16}.jsp. New shells may have been dropped at different times with different names; review all recent.jspfile writes to the login directory. - Review PTC’s published indicators of compromise for additional file hashes and behavioural patterns released on June 18.
- Restrict external exposure: Audit which Windchill instances are internet-reachable and apply network-layer controls to limit access to known IP ranges where operationally feasible.
- Check for lateral movement: Any Windchill host that was internet-reachable before patching should be treated as potentially compromised and subjected to a full lateral movement investigation, including review of adjacent hosts, credential stores, and outbound connections.