Exploited PTC Windchill RCE Flaw Added to KEV Catalog

| 2026-06-26 12:31 CRITICAL HIGH

JSON

Executive Summary AI-generated

The newly added remote code execution vulnerability in PTC Windchill PDMlink and PTC FlexPLM software has been identified as CVE-2026-12569, a case of improper input validation that could allow an attacker to execute arbitrary code by sending a malicious request to the network. Despite patches being released last week, unknown attackers continue to exploit the vulnerability to deploy JSP web shells against susceptible systems. The incident highlights how threat actors are rapidly weaponizing newly disclosed vulnerabilities to their advantage and underscores the need for immediate action from affected organizations to mitigate potential risks.

Technical Mitigations AI-generated

* Implement a Web Application Firewall (WAF) and Intrusion Detection System (IDS): Configure your organization's WAF to block any request containing the header X-windchill-req, which is used by attackers to exploit the PTC Windchill vulnerability. Additionally, install an IDS system that can detect and alert on suspicious activity. * Implement a Content Security Policy (CSP) with strict filtering: Configure your organization's CSP to filter out malicious content from JSP files matching the 16-hex-char pattern /Windchill/login/[0-9a-f]{16}. This will prevent attackers from exploiting the PTC Windchill vulnerability by injecting malicious code into legitimate web shells. * Regularly scan for and remove suspicious JSP files: Use an automated tool to regularly scan your organization's filesystem for JSP files matching the 16-hex-char pattern /Windchill/login/[0-9a-f]{16}. Remove any such files that are found, as they may be used by attackers to escalate privileges. * Implement a secure login endpoint configuration: Restrict internet exposure of the Windchill login endpoint where operationally possible. This will prevent attackers from exploiting the PTC Windchill vulnerability by using the login endpoint for malicious activities. * Monitor HTTP access logs and system logs for suspicious activity: Regularly monitor your organization's HTTP access logs and system logs for any POST requests to /Windchill/login/*.jsp or other suspicious activity that may indicate an attacker is attempting to exploit the PTC Windchill vulnerability.

Technical Observables

sha256


                                            
                                                55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c

files


                                            
                                                flst.txt

ips


                                            
                                                5.180.41.35


                                            
                                                74.50.76.146


                                            
                                                216.152.148.54


                                            
                                                104.243.35.131


                                            
                                                172.111.38.31

Intelligence Metadata

Actors / Malware / CVEs / Campaigns

CVE-2026-12569 CVE-2026-20230

Target & Sectors

Global Scope

Incident Timeline

‎2026/06/19

Threat actors used PTC's KEV software to exploit a previously undisclosed Remote Code Execution (RCE) flaw in JSP web applications.

Click on any entity below to view its context and source!

organisation PTC

Although patches for the flaw were released last week, PTC has since confirmed, as of June 25, that "we've received continued reports of heightened threat activity," with the company disclosing that unknown attackers are exploiting the vulnerability to deploy JSP web shells against susceptible systems.

Suggestions