Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

CVE-2026-12569 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceCVE-2026-12569

CVE-2026-12569

CRITICAL9.3

Remote Code Execution (RCE) vulnerability in Windchill PDMlink

Published Jun 18, 2026

Modified 5 days ago

Details

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions

The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

References

https://www.cve.org/CVERecord?id=CVE-2026-12569

https://www.ptc.com/en/support/article/CS473270

CVSS Analysis

CVSS v4.0

9.3

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

HighVC:H

Vuln. Integrity

HighVI:H

Vuln. Availability

HighVA:H

Subsequent System

Subseq. Confidentiality

LowSC:L

Subseq. Integrity

LowSI:L

Subseq. Availability

LowSA:L

9.3/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/U:Red

Weakness Type (CWE)

Input Validation

Improper Input Validation

Serialization

Deserialization of Untrusted Data

Ecosystems

Timeline

PublishedJun 18, 2026

ModifiedJun 18, 2026