CVE-2026-12569: Remote Code Execution (RCE) vulnerability in Windchill PDMlink

Synopsis

An insecure deserialization vulnerability in PTC Windchill PDMLink (and FlexPLM) allows a remote, unauthenticated attacker to execute arbitrary code on the host running the affected service. The vulnerability is reachable over the network with no credentials and no victim interaction required, making it trivially weaponizable at scale. Successful exploitation gives an attacker full control over the server, including the ability to read, modify, or destroy data and disrupt service availability. No upstream fix has been published; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment PTC releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service is exposed over the network; an attacker must be able to reach it via HTTP or a similar application protocol to deliver a malicious serialized payload.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable deserialization endpoint is reachable without logging in.

• Victim interactionNot required

  The attack is fully server-side; no user needs to click a link, open a file, or take any action for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is low - the exploit requires no race conditions, special memory layout, or other environmental prerequisites and can be executed reliably against any reachable affected instance.

Blast Radius

• Attacker executes arbitrary operating system commands as the process owner of the Windchill or FlexPLM application server, achieving full host-level code execution.
• Attacker reads product lifecycle data, engineering files, and any credentials or secrets stored on or accessible from the compromised host.
• Attacker modifies or deletes PLM records, bills of materials, and configuration data persisted in the application database.
• Attacker crashes or holds the application service hostage, causing a complete denial of service for engineering and manufacturing workflows dependent on Windchill PDMLink or FlexPLM.