PTC patches critical RCE vulnerability in Windchill and FlexPLM exploited by Cl0p ransomware group
PTC has released security patches addressing a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-126325, affecting multiple versions of its Windchill and FlexPLM products. The flaw, stemming from improper input validation and unsafe deserialization of untrusted data, holds a CVSS v4 score of 9.2 and could be exploited via crafted requests to execute arbitrary code remotely. This disclosure follows a previous critical RCE issue (CVE-2026-12569) in the same products that was actively exploited by threat actors affiliated with the Cl0p ransomware group to deploy JSP web shells and exfiltrate sensitive manufacturing data. PTC has applied patches for hosted environments and urges users managing on-premises deployments to patch immediately or implement network restrictions to mitigate risk. Given the products' crucial role in manufacturing and industrial processes, the exploitation can have significant operational and financial impact.
Entenda a falha
A vulnerabilidade
CVE-2026-126325 is a critical remote code execution flaw (CVSS v4 9.2) in PTC Windchill and PTC FlexPLM. It is described as improper input validation and deserialization of untrusted data, exploitable through crafted requests. The CVE record lists Windchill 11.0 M030 through 13.1.4.0 and FlexPLM 11.0 M030 through 13.1.3.0 as affected. The articles do not state the fixed version numbers, only that PTC released patches. Authentication requirements are not specified. The earlier CVE-2026-12569 (CVSS 9.3) is a critical RCE in the same products that was actively exploited, and Cl0p-linked actors used it in July 2026 to drop JSP web shells and steal data.
Como funciona
According to the CVE description, a crafted request reaches the Windchill or FlexPLM server, which deserializes data supplied by the requester without properly validating it. Because the untrusted data is turned back into objects, the attacker can make the server run code of their choosing. The articles do not name the endpoint or the exact step where this happens.
Por que é vulnerável
The root cause is improper input validation combined with deserialization of untrusted data: the software trusts serialized input from requests instead of checking or restricting it. The articles give no detail on why it went unnoticed or on what the patch changes in the code.
Como foi descoberta
The articles do not say who found CVE-2026-126325 or how. PTC published a statement and the CVE record on CVE.org describes it as a reported critical RCE. PTC says it already patched environments it hosts, and customers running their own deployments must apply the patch. The related CVE-2026-12569 came to light through active exploitation, and Cl0p-linked activity was reported in July 2026.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 11:15.
Linha do tempo
-
PTC patches critical RCE vulnerability in Windchill and FlexPLM exploited by Cl0p ransomware group
ler a análise desta fonte ocultar
PTC has released security patches addressing a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-126325, affecting multiple versions of its Windchill and FlexPLM products. The flaw, stemming from improper input validation and unsafe deserialization of untrusted data, holds a CVSS v4 score of 9.2 and could be exploited via crafted requests to execute arbitrary code remotely. This disclosure follows a previous critical RCE issue (CVE-2026-12569) in the same products that was actively exploited by threat actors affiliated with the Cl0p ransomware group to deploy JSP web shells and exfiltrate sensitive manufacturing data. PTC has applied patches for hosted environments and urges users managing on-premises deployments to patch immediately or implement network restrictions to mitigate risk. Given the products' crucial role in manufacturing and industrial processes, the exploitation can have significant operational and financial impact.