{"history":[{"alert":0,"cve":"CVE-2026-12569","id":23232,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.46049, \"percentile\": 0.98827}"},{"alert":0,"cve":"CVE-2026-12569","id":20709,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.46049, \"percentile\": 0.98819}"},{"alert":0,"cve":"CVE-2026-12569","id":18547,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.46049, \"percentile\": 0.98818}"},{"alert":0,"cve":"CVE-2026-12569","id":16618,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.46049, \"percentile\": 0.98817}"},{"alert":0,"cve":"CVE-2026-12569","id":14596,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.46049, \"percentile\": 0.98815}"},{"alert":0,"cve":"CVE-2026-12569","id":12378,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.46049, \"percentile\": 0.98815}"},{"alert":0,"cve":"CVE-2026-12569","id":10366,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.46049, \"percentile\": 0.98814}"},{"alert":0,"cve":"CVE-2026-12569","id":7916,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.46049, \"percentile\": 0.98813}"},{"alert":0,"cve":"CVE-2026-12569","id":5696,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.46049, \"percentile\": 0.98811}"},{"alert":1,"cve":"CVE-2026-12569","id":3923,"kind":"cna","observed_at":1793701200,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-12569\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-06-25T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-06-25\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-08-01T03:55:29.806Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"Windchill PDMLink\", \"vendor\": \"PTC\", \"versions\": [{\"lessThanOrEqual\": \"11.0 M030\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.1 M020\"}, {\"status\": \"affected\", \"version\": \"11.2.1.0\"}, {\"status\": \"affected\", \"version\": \"12.0.2.0\"}, {\"status\": \"affected\", \"version\": \"12.1.2.0\"}, {\"status\": \"affected\", \"version\": \"13.0.2.0\"}, {\"status\": \"affected\", \"version\": \"13.1.0.0\"}, {\"status\": \"affected\", \"version\": \"13.1.1.0\"}, {\"status\": \"affected\", \"version\": \"13.1.2.0\"}, {\"status\": \"affected\", \"version\": \"13.1.3.0\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"FlexPLM\", \"vendor\": \"PTC\", \"versions\": [{\"lessThanOrEqual\": \"11.0 M030\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.1 M020\"}, {\"status\": \"affected\", \"version\": \"11.2.1.0\"}, {\"status\": \"affected\", \"version\": \"12.0.0.0\"}, {\"status\": \"affected\", \"version\": \"12.0.2.0\"}, {\"status\": \"affected\", \"version\": \"12.1.2.0\"}, {\"status\": \"affected\", \"version\": \"12.1.3.0\"}, {\"status\": \"affected\", \"version\": \"13.0.2.0\"}, {\"status\": \"affected\", \"version\": \"13.0.3.0\"}]}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. 
\"}], \"value\": \"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\\u00a0 * This advisory also applies to all CPS versions\\n * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030\"}], \"impacts\": [{\"capecId\": \"CAPEC-586\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-586 Object Injection\"}]}, {\"capecId\": \"CAPEC-153\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-153 Input Data Manipulation\"}]}], \"metrics\": [{\"cvssV4_0\": {\"Automatable\": \"YES\", \"Recovery\": \"USER\", \"Safety\": \"NOT_DEFINED\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"attackVector\": \"NETWORK\", \"baseScore\": 9.3, \"baseSeverity\": \"CRITICAL\", \"exploitMaturity\": \"NOT_DEFINED\", \"privilegesRequired\": \"NONE\", \"providerUrgency\": \"RED\", \"subAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"LOW\", \"subIntegrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"valueDensity\": \"CONCENTRATED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/U:Red\", \"version\": \"4.0\", \"vulnAvailabilityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper input validation\", \"lang\": \"en\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of untrusted data\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-06-18T00:11:35.241Z\", \"orgId\": \"0b655efc-079c-4cb9-9e8d-164871239f4e\", \"shortName\": \"PTC\"}, \"references\": [{\"tags\": [\"vendor-advisory\", \"mitigation\", \"permissions-required\"], \"url\": \"https://www.ptc.com/en/support/article/CS473270\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"title\": \"Remote Code Execution (RCE) vulnerability in Windchill PDMlink\", \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}}}, \"cveMetadata\": {\"assignerOrgId\": \"0b655efc-079c-4cb9-9e8d-164871239f4e\", \"assignerShortName\": \"PTC\", \"cveId\": \"CVE-2026-12569\", \"datePublished\": \"2026-06-18T00:11:35.241Z\", \"dateReserved\": \"2026-06-18T00:02:58.904Z\", \"dateUpdated\": \"2026-08-01T03:55:29.806Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2026-12569","id":3525,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.46049, \"percentile\": 0.9881}"},{"alert":1,"cve":"CVE-2026-12569","id":138,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2026-12569\", \"cwes\": [\"CWE-20\", \"CWE-502\"], \"dateAdded\": \"2026-06-25\", \"dueDate\": \"2026-06-28\", \"forensicTriage\": \"Yes\", \"knownRansomwareCampaignUse\": \"Known\", \"notes\": \"https://www.ptc.com/en/support/article/CS473270 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-12569\", \"product\": \"Windchill and FlexPLM\", \"requiredAction\": \"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\\u2019s \\u201cForensics Triage Requirements\\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.\", \"shortDescription\": \"PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.\", \"vendorProject\": \"PTC\", \"vulnerabilityName\": \"PTC Windchill and FlexPLM Improper Input Validation Vulnerability\"}"}],"record":{"affected":[{"defaultStatus":"unaffected","product":"Windchill PDMLink","vendor":"PTC","versions":[{"lessThanOrEqual":"11.0 M030","status":"affected","version":"0","versionType":"semver"},{"status":"affected","version":"11.1 M020"},{"status":"affected","version":"11.2.1.0"},{"status":"affected","version":"12.0.2.0"},{"status":"affected","version":"12.1.2.0"},{"status":"affected","version":"13.0.2.0"},{"status":"affected","version":"13.1.0.0"},{"status":"affected","version":"13.1.1.0"},{"status":"affected","version":"13.1.2.0"},{"status":"affected","version":"13.1.3.0"}]},{"defaultStatus":"unaffected","product":"FlexPLM","vendor":"PTC","versions":[{"lessThanOrEqual":"11.0 M030","status":"affected","version":"0","versionType":"semver"},{"status":"affected","version":"11.1 M020"},{"status":"affected","version":"11.2.1.0"},{"status":"affected","version":"12.0.0.0"},{"status":"affected","version":"12.0.2.0"},{"status":"affected","version":"12.1.2.0"},{"status":"affected","version":"12.1.3.0"},{"status":"affected","version":"13.0.2.0"},{"status":"affected","version":"13.0.3.0"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-12569","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-06-25T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-06-25","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-08-01T03:55:29.806Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Windchill PDMLink","vendor":"PTC","versions":[{"lessThanOrEqual":"11.0 M030","status":"affected","version":"0","versionType":"semver"},{"status":"affected","version":"11.1 M020"},{"status":"affected","version":"11.2.1.0"},{"status":"affected","version":"12.0.2.0"},{"status":"affected","version":"12.1.2.0"},{"status":"affected","version":"13.0.2.0"},{"status":"affected","version":"13.1.0.0"},{"status":"affected","version":"13.1.1.0"},{"status":"affected","version":"13.1.2.0"},{"status":"affected","version":"13.1.3.0"}]},{"defaultStatus":"unaffected","product":"FlexPLM","vendor":"PTC","versions":[{"lessThanOrEqual":"11.0 M030","status":"affected","version":"0","versionType":"semver"},{"status":"affected","version":"11.1 M020"},{"status":"affected","version":"11.2.1.0"},{"status":"affected","version":"12.0.0.0"},{"status":"affected","version":"12.0.2.0"},{"status":"affected","version":"12.1.2.0"},{"status":"affected","version":"12.1.3.0"},{"status":"affected","version":"13.0.2.0"},{"status":"affected","version":"13.0.3.0"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. 
"}],"value":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\u00a0 * This advisory also applies to all CPS versions\n * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030"}],"impacts":[{"capecId":"CAPEC-586","descriptions":[{"lang":"en","value":"CAPEC-586 Object Injection"}]},{"capecId":"CAPEC-153","descriptions":[{"lang":"en","value":"CAPEC-153 Input Data Manipulation"}]}],"metrics":[{"cvssV4_0":{"Automatable":"YES","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"RED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/U:Red","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper input validation","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-502","description":"CWE-502 Deserialization of untrusted data","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-06-18T00:11:35.241Z","orgId":"0b655efc-079c-4cb9-9e8d-164871239f4e","shortName":"PTC"},"references":[{"tags":["vendor-advisory","mitigation","permissions-required"],"url":"https://www.ptc.com/en/support/article/CS473270"}],"source":{"discovery":"UNKNOWN"},"title":"Remote Code Execution (RCE) vulnerability in Windchill PDMlink","x_generator":{"engine":"Vulnogram 1.0.2"}}},"cveMetadata":{"assignerOrgId":"0b655efc-079c-4cb9-9e8d-164871239f4e","assignerShortName":"PTC","cveId":"CVE-2026-12569","datePublished":"2026-06-18T00:11:35.241Z","dateReserved":"2026-06-18T00:02:58.904Z","dateUpdated":"2026-08-01T03:55:29.806Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794133200,"cve":"CVE-2026-12569","description":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\u00a0 * This advisory also applies to all CPS versions\n * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030","epss":{"date":"2026-11-12","epss":0.46049,"percentile":0.98827},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2026-12569","cwes":["CWE-20","CWE-502"],"dateAdded":"2026-06-25","dueDate":"2026-06-28","forensicTriage":"Yes","knownRansomwareCampaignUse":"Known","notes":"https://www.ptc.com/en/support/article/CS473270 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-12569","product":"Windchill and FlexPLM","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.","vendorProject":"PTC","vulnerabilityName":"PTC Windchill and FlexPLM Improper Input Validation Vulnerability"},"kev_checked":1794522003,"products":"PTC Windchill PDMLink, PTC FlexPLM","references":["https://www.ptc.com/en/support/article/CS473270","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569"],"score":{"Automatable":"YES","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","provider":"PTC","providerUrgency":"RED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/U:Red","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"solutions":"","state":"PUBLISHED","title":"Remote Code Execution (RCE) vulnerability in Windchill PDMlink","updated_at":1794500401,"workarounds":""},"sources":[]}