CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability affecting PTC Windchill PDMlink and PTC FlexPLM to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. The vulnerability, tracked as CVE-2026-12569 with a CVSS score of 9.3, stems from improper input validation that allows arbitrary code execution via deserialization of untrusted data.

PTC released patches last week but confirmed continued threat activity as of June 25, 2026, with attackers exploiting the flaw to deploy JSP web shells on vulnerable systems. Indicators of compromise include IP addresses such as 172.111.38.31, 216.152.148.54, 104.243.35.131, 74.50.76.146, and 5.180.41.35 (the latter identified as a command-and-control address), along with web shell files matching the pattern /Windchill/login/[0-9a-f]{16}.jsp.

Mitigation recommendations include blocking the C2 IP at perimeter firewalls, searching HTTP access logs for POST requests to /Windchill/login/*.jsp, scanning for the specified JSP file pattern, hash-checking suspicious files against the provided SHA-256 hash, checking for flst.txt in /tmp or the Windchill working directory, adding WAF/IDS rules to block requests containing the header X-windchill-req, and restricting internet exposure of the Windchill login endpoint where possible.

This marks the first PTC product vulnerability added to CISA’s KEV catalog, highlighting the rapid weaponization of newly disclosed vulnerabilities by threat actors.