Threat Overview
CVE-2026-12569 is a critical unauthenticated remote-code-execution vulnerability in PTC Windchill PDMLink and FlexPLM caused by unsafe deserialization. The flaw is in CISA’s Known Exploited Vulnerabilities catalog and has been used in attacks that deploy JSP web shells under the Windchill login path.
Check Point’s August 24 threat-intelligence report highlighted continuing Cl0p extortion activity tied to this vulnerability and reported more than 40 organizations named by the group. PTC has published concrete hunting indicators, including 16-character lowercase hexadecimal JSP web-shell names under /Windchill/login/ and the malicious header X-windchill-req.
References
Impacted Systems
| Vendor | PTC |
| Products | Windchill PDMLink and FlexPLM |
| Vulnerability | CVE-2026-12569 — unauthenticated RCE via deserialization of untrusted data |
| Affected Windchill releases | Includes releases through 11.0 M030 and specifically listed 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0 |
| Affected FlexPLM releases | Includes releases through 11.0 M030 and specifically listed 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0 |
| Deployment | Self-managed / on-premises directly actionable; PTC states PTC-hosted instances are remediated on customers’ behalf |
| Higher-risk exposure | Internet-facing Windchill/FlexPLM services |
What this hunt looks for
Looks for known and behavioral indicators of CVE-2026-12569 exploitation, including 16-character hexadecimal JSP web shells under /Windchill/login/, PTC’s published malicious request-header indicator, and suspicious shell or downloader activity spawned by Java or web-server processes.
Required logs
CommonSecurityLog with Windchill, reverse-proxy, or WAF HTTP telemetry; and DeviceProcessEvents.
First-Pass — Hex-Named Windchill JSP Web Shell Requests
CommonSecurityLog
| where TimeGenerated >= ago(60d)
| where RequestURL matches regex @"/Windchill/login/[0-9a-f]{16}\.jsp"
| project TimeGenerated, SourceIP, DestinationHostName, RequestMethod, RequestURL, RequestClientApplication, Message
| sort by TimeGenerated ascFollow-Up — Known Windchill Web Shell Paths or Header Indicator
CommonSecurityLog
| where TimeGenerated >= ago(60d)
| where RequestURL has_any ("/Windchill/login/7c0a0a34c9d8d53b.jsp","/Windchill/login/46b158b8607a4c00.jsp","/Windchill/login/64652883d9de3299.jsp","/Windchill/login/56c9be44a436c4a2.jsp","/Windchill/login/4b57d0652345d383.jsp","/Windchill/login/ec6ba805a076e709.jsp") or Message has "X-windchill-req"
| project TimeGenerated, SourceIP, DestinationHostName, RequestMethod, RequestURL, Message
| sort by TimeGenerated ascFollow-Up — Java / Web Server Child Process Activity
DeviceProcessEvents
| where TimeGenerated >= ago(60d)
| where InitiatingProcessFileName in~ ("java.exe","java","tomcat.exe","tomcat9.exe","httpd.exe","httpd","apache2")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","sh","bash","curl","wget","certutil.exe","python.exe","python")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc
Killian Sherer 