{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-06T05:30:53.599","vulnerabilities":[{"cve":{"id":"CVE-2026-12569","sourceIdentifier":"0b655efc-079c-4cb9-9e8d-164871239f4e","published":"2026-06-18T01:18:12.040","lastModified":"2026-08-01T05:16:55.023","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.   *  This advisory also applies to all CPS versions\n  *  The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030"}],"affected":[{"source":"0b655efc-079c-4cb9-9e8d-164871239f4e","affectedData":[{"vendor":"PTC","product":"Windchill PDMLink","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"11.0 M030","versionType":"semver","status":"affected"},{"version":"11.1 M020","status":"affected"},{"version":"11.2.1.0","status":"affected"},{"version":"12.0.2.0","status":"affected"},{"version":"12.1.2.0","status":"affected"},{"version":"13.0.2.0","status":"affected"},{"version":"13.1.0.0","status":"affected"},{"version":"13.1.1.0","status":"affected"},{"version":"13.1.2.0","status":"affected"},{"version":"13.1.3.0","status":"affected"}]},{"vendor":"PTC","product":"FlexPLM","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"11.0 M030","versionType":"semver","status":"affected"},{"version":"11.1 M020","status":"affected"},{"version":"11.2.1.0","status":"affected"},{"version":"12.0.0.0","status":"affected"},{"version":"12.0.2.0","status":"affected"},{"version":"12.1.2.0","status":"affected"},{"version":"12.1.3.0","status":"affected"},{"version":"13.0.2.0","status":"affected"},{"version":"13.0.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"0b655efc-079c-4cb9-9e8d-164871239f4e","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:Red","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"USER","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"RED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-25T00:00:00+00:00","id":"CVE-2026-12569","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-06-25","cisaActionDue":"2026-06-28","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"PTC Windchill and FlexPLM Improper Input Validation Vulnerability","weaknesses":[{"source":"0b655efc-079c-4cb9-9e8d-164871239f4e","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:flexplm:*:*:*:*:*:*:*:*","versionEndIncluding":"11.0m030","matchCriteriaId":"9645DC27-47FD-4E68-A73F-380DE6AB9265"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:flexplm:11.1m020:*:*:*:*:*:*:*","matchCriteriaId":"1BA9771B-C606-4B0D-ADF1-E0BEA4FD5407"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:flexplm:11.2.1.0:*:*:*:*:*:*:*","matchCriteriaId":"AF4D5C35-1E36-4A6E-86AA-5E26F5375E84"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:flexplm:12.0.0.0:*:*:*:*:*:*:*","matchCriteriaId":"2A5BC13C-CBF4-4EA8-B5B7-E680BF7B22DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:flexplm:12.0.2.0:*:*:*:*:*:*:*","matchCriteriaId":"0A7DB804-FA55-456C-8C58-7ACBDA710F45"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:flexplm:12.1.3.0:*:*:*:*:*:*:*","matchCriteriaId":"AABF3817-5BA7-4604-92D3-468B73EEDA75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:flexplm:13.0.2.0:*:*:*:*:*:*:*","matchCriteriaId":"33798622-E630-4F62-B675-01BFC99E73CC"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:flexplm:13.0.3.0:*:*:*:*:*:*:*","matchCriteriaId":"5D992EFD-F674-4217-9078-FAD2558168D5"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:windchill_pdmlink:*:*:*:*:*:*:*:*","versionEndExcluding":"11.0m030","matchCriteriaId":"A8E8CEE8-BECD-4D33-B14F-BA015EF0E39F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:windchill_pdmlink:11.0m030:-:*:*:*:*:*:*","matchCriteriaId":"C456B19A-8A53-47AA-8C44-D7E4A99D73D0"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:windchill_pdmlink:11.1m020:-:*:*:*:*:*:*","matchCriteriaId":"6B33DB9C-7883-495B-ACFF-31422ED4A256"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:windchill_pdmlink:11.2.1.0:-:*:*:*:*:*:*","matchCriteriaId":"631EB791-4C82-4A73-8793-465576C47EC2"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:windchill_pdmlink:12.0.2.0:-:*:*:*:*:*:*","matchCriteriaId":"5AAE2484-F8D6-4842-93E3-EAA12469B800"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:windchill_pdmlink:12.1.2.0:-:*:*:*:*:*:*","matchCriteriaId":"FC145374-1ABE-4067-9649-EEE6D031C139"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:windchill_pdmlink:13.0.2.0:-:*:*:*:*:*:*","matchCriteriaId":"925FF6A1-A0A0-4B0F-878A-53CE23ECF2D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:windchill_pdmlink:13.1.0.0:*:*:*:*:*:*:*","matchCriteriaId":"D9658DCC-7527-4BDE-BEC1-D5C43A7C7B83"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:windchill_pdmlink:13.1.1.0:-:*:*:*:*:*:*","matchCriteriaId":"6619674F-DABA-420B-88BC-0CFDF2972309"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:windchill_pdmlink:13.1.2.0:*:*:*:*:*:*:*","matchCriteriaId":"0FF72930-943F-4A01-BC2A-6AEACBD38908"},{"vulnerable":true,"criteria":"cpe:2.3:a:ptc:windchill_pdmlink:13.1.3.0:*:*:*:*:*:*:*","matchCriteriaId":"AD29599D-F30B-4664-A8F7-59C256ABAB61"}]}]}],"references":[{"url":"https://www.ptc.com/en/support/article/CS473270","source":"0b655efc-079c-4cb9-9e8d-164871239f4e","tags":["Permissions Required"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}}]}