THE BASE COLLECTIONCRDS / 0.1

CVE-2026-12569CRITICAL

PTC Windchill and FlexPLM

KNOWN EXPLOITED

initial accessT1190

Windchill PDMlink and FlexPLM rebuild objects from untrusted data without validating it, so an unauthenticated attacker who can reach the server over the network can run code on it and get at the product data it holds.

CVSS

9.8

EPSS

41%

PATCH

—

Apply PTC's fix from article CS473270 now; ransomware operators use this, so isolate Windchill from the internet and check for unexpected server-side processes.

SCRTY:CRDS / BASE SETREV. 01 ◆

Raw JSON

One vulnerability. The facts that matter.
A clear next move.

critical Known exploitedREV. 01

CVE-2026-12569PTC Windchill and FlexPLM — deserialization to unauthenticated RCE

YOUR NEXT MOVE

Apply PTC's fix from article CS473270 now; ransomware operators use this, so isolate Windchill from the internet and check for unexpected server-side processes.

Read the risk

THE VITAL STATS

CVSS score: 9.8/ 10
EPSS probability: 41%
Attack complexity: Low
Known exploited: Yes — CISA KEV
CVE published: 2026-06-18
Added to KEV: 2026-06-25
Exploit published: Not recorded
Confidence: high
Kill chain: initial access
MITRE ATT&CK: T1190
Severity: critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attacker needsNetwork access to the Windchill or FlexPLM application server; no credentials needed.

Behind the card

2 REFERENCES

Field-level provenanceTRACE THE SOURCES +

Which source supports each field, when it was retrieved, and who extracted it.

Fields	Source	Retrieved	Extractor	Confidence
cvss, exploitation.attack_complexity, exploitation.exploit_available, references, published_at	nvd.nist.gov	2026-09-23	scrty-crds-pipeline/0.1	high
exploitation.known_exploited, exploitation.kev_added	cisa.gov	2026-09-23	scrty-crds-pipeline/0.1	high
epss	api.first.org	2026-09-23	scrty-crds-pipeline/0.1	high
title, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites	nvd.nist.gov	2026-09-23	claude-code	high

Printing history

THE RECORD

r12026-09-23Initial base card

First printing. This card has not been reprinted since publication.