PTC Windchill & FlexPLM — CVE-2026-12569

CVE-2026-12569 (CVSS 9.3) is an unsafe-deserialization of untrusted data flaw in the web-based Windchill PDMLink product-data-management component of PTC Windchill (and the FlexPLM product built on it). An unauthenticated, remote attacker who sends a crafted request to the Windchill web tier triggers deserialization of an attacker-controlled Java object gadget chain, resulting in arbitrary code execution in the context of the Windchill / Tomcat application-server service account. This is the first PTC product ever added to the CISA KEV catalog.

PTC alerted customers with mitigation guidance on June 17 2026 (advisory CS473270), released patches on June 19, and CISA added the flaw to the KEV catalog on June 25 2026 with a federal remediation deadline of June 28. Fixed/target releases are Windchill 13.1.1, 13.0.2, 12.1.2, 12.0.2, 11.2.1, 11.1 M020, and 11.0 M030 (and the corresponding FlexPLM builds). Post-exploitation, attackers deploy persistent JSP web shells that grant remote command execution and data exfiltration — public reporting notes web shells named with 16 lowercase hex characters, so defenders should hunt web/access logs for requests to /Windchill/login/[0-9a-f]{16}.jsp (The Hacker News).

Windchill holds an organization's most sensitive engineering IP — CAD, BOMs, manufacturing specs — so RCE on the PLM tier is a direct data-theft and supply-chain-integrity risk. Because the flaw is pre-auth and the app tier is often internet- or partner-reachable, exposure is high wherever the fix has not landed. The highest-value defensive angles are two: (1) the web-shell artifact — the 16-hex .jsp file and any request to it; and (2) the process anomaly — the Windchill/Tomcat java service spawning a shell or LOLBin, which no legitimate PLM workflow does.

Defender priority: Patch to the fixed release for your branch now (13.1.1 / 13.0.2 / 12.1.2 / 12.0.2 / 11.2.1 / 11.1 M020 / 11.0 M030). In parallel, hunt every Windchill host's web/access logs for /Windchill/login/<16-hex>.jsp and Falcon process telemetry for the java/Tomcat service spawning cmd.exe/powershell.exe/sh. Treat any hit as a compromise until proven otherwise — patching does not remove an already-planted web shell.

PTC published IOCs alongside advisory CS473270; the atomic attacker IPs/hashes there are tenant-perishable and were not fully reproduced in open reporting as of 2026-07-01. Detection in this pack is therefore behavioral and log-based — the 16-hex JSP web-shell path and anomalous children of the Windchill/Tomcat java service — with placeholders in the IOC CSV for the vendor atomic indicators.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): The Windchill/Tomcat java service account spawned a shell or LOLBin (cmd.exe/powershell.exe/sh/whoami) — web-shell command execution. T1190 / T1059 / T1505.003
2. H2 (high): Web/access logs show a request to /Windchill/login/<16-hex>.jsp — the deployed JSP web shell being planted or invoked. T1505.003
3. H3 (high): A pre-auth POST to a Windchill endpoint carried a Java serialized-object payload (base64 magic rO0AB) — the deserialization exploitation attempt. T1190
4. H4 (medium-high): The Windchill java service made anomalous outbound connections to a rare external IP — data exfiltration / C2 egress from the PLM tier. T1041 / T1071
5. H5 (medium): The Windchill java parent launched download/exfil tooling (certutil, bitsadmin, curl, wget, encoded PowerShell) — staging of second-stage tooling. T1105
6. H6 (medium): A new .jsp/executable was written under the Windchill/Tomcat webapps or temp path, or persistence (service/cron/account) appeared on the host. T1505.003 / T1053 / T1136

Attack chain

⚠ Telemetry reality: Q2–Q3 assume Windchill/Tomcat/proxy web-access logs are ingested into NGSIEM/LogScale (a custom repo) — replace #repo=windchill_web and the parsed field names (method, url, status, src_ip, http_user_agent) with your ingest's actual values. Q1, Q4, Q5 are Falcon endpoint queries that apply directly wherever a sensor covers the Windchill host.

• On each Windchill host: search the Tomcat/web access logs for any request path matching /Windchill/login/ followed by 16 lowercase hex characters and .jsp — the web-shell fingerprint. Any hit, on any HTTP method, is high-priority.
• Filesystem sweep: enumerate the Windchill/Tomcat webapps, work, and temp directories for .jsp files whose name is 16 hex characters, or any .jsp created after the June 17 disclosure that is not part of the shipped application.
• Process ancestry review: on the Windchill host, list child processes of the java/Tomcat service since disclosure — any cmd.exe, powershell.exe, sh, bash, whoami, or network tool is anomalous.
• Patch-state confirmation: record each Windchill instance's version and confirm it is at or above the fixed release for its branch (13.1.1 / 13.0.2 / 12.1.2 / 12.0.2 / 11.2.1 / 11.1 M020 / 11.0 M030); flag any lagging instance for emergency patching.
• PTC IOC correlation: pull the atomic IOCs from advisory CS473270 and sweep proxy/firewall logs and endpoint hashes for matches.

Q1 and Q5 are strong Custom IOA candidates because the parent→child relationship is deterministic and benign PLM workflows never trigger it. Q2 (web-shell path) is best run as an NGSIEM scheduled search over ingested access logs and promoted to a Critical alert after a short baseline.

1 — Sweep a Windchill host for 16-hex JSP web shells (Linux/Tomcat)

#!/usr/bin/env bash
# Run on each Windchill app server. Finds JSP files whose basename is 16 hex chars.
WEBROOT="${1:-/opt/ptc/Windchill}"
find "$WEBROOT" -type f -iname '*.jsp' 2>/dev/null \
  | grep -E '/[0-9a-f]{16}\.jsp$' \
  | tee /tmp/windchill_webshell_hits.txt
echo "[*] $(wc -l < /tmp/windchill_webshell_hits.txt) suspicious JSP(s) found"

2 — Windows sweep + access-log grep (PowerShell)

# Web-shell files on a Windows Windchill host + access-log hits.
$root = 'C:\ptc\Windchill'
Get-ChildItem -Path $root -Recurse -Filter *.jsp -ErrorAction SilentlyContinue |
  Where-Object { $_.BaseName -match '^[0-9a-f]{16}$' } |
  Select-Object FullName, CreationTime, Length
Select-String -Path 'C:\ptc\Windchill\tomcat\logs\localhost_access*.log' `
  -Pattern '/Windchill/login/[0-9a-f]{16}\.jsp'

3 — NGSIEM scheduled-search alert (LogScale) for the web shell (Q2)

# Schedule as a recurring search; severity Critical, notify SOC.
#repo=windchill_web
| url=/\/Windchill\/login\/[0-9a-f]{16}\.jsp/

4 — WAF rule sketch (block the web-shell path + serialized payloads)

# ModSecurity-style: block 16-hex JSP under /Windchill/login/ and rO0AB bodies.
SecRule REQUEST_URI "@rx /Windchill/login/[0-9a-f]{16}\.jsp" \
  "id:926001,phase:1,deny,status:403,log,msg:'Windchill CVE-2026-12569 webshell path'"
SecRule REQUEST_BODY "@rx rO0AB[A-Za-z0-9+/=]{6}" \
  "id:926002,phase:2,deny,status:403,log,msg:'Windchill CVE-2026-12569 Java deserialization'"

Known gaps: the exploitation attempt itself (Q3) is only visible if the proxy/WAF captures request bodies or URIs — many access logs do not, so Q1/Q2 (post-exploitation) are the durable detections. On Windchill hosts without a Falcon sensor, Q1/Q4/Q5/Q6 do not apply and coverage collapses to ingested web logs (Q2/Q3) — prioritize sensor coverage or log forwarding on the PLM tier. Atomic attacker IOCs live in PTC advisory CS473270; the §10 CSV uses placeholders until they are imported.