Loading story…
PTC disclosed CVE-2026-4681, a critical deserialization flaw in Windchill PDMLink and FlexPLM that can allow remote code execution. The vulnerability affects multiple major release branches, including 11.x, 12.x, and 13.x, with impacted builds including CPS releases before 11.0 M030. PTC rated the issue CVSS v3.1 10.0 and CVSS v4 9.3, and said the risk is highest for publicly accessible instances.
PTC said it has no evidence of active exploitation affecting customers at this time, but issued urgent mitigation guidance while patches are pending. The company advised administrators to apply protections in Apache HTTP Server and Microsoft IIS, extend the same controls to File Server and Replica Server deployments, and disconnect exposed systems or shut services down if mitigations cannot be applied. PTC also published indicators of compromise, including suspicious HTTP request patterns, a specific Chrome user-agent string, malicious filenames, a payload.bin SHA-256 hash, and related log messages; for PTC cloud-hosted customers, the Apache workaround has already been deployed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
PTC published an urgent advisory for CVE-2026-4681, rating it critical and warning that publicly accessible instances are especially at risk. The company said it had no evidence of active customer exploitation, provided temporary mitigations for Apache HTTP Server and Microsoft IIS, noted the Apache workaround was already deployed for cloud-hosted customers, and released indicators of compromise tied to exploitation attempts.
A critical deserialization flaw affecting PTC Windchill PDMLink and PTC FlexPLM was reported, with impact across multiple 11.x, 12.x, and 13.x release branches. The issue could allow remote code execution through improper handling of untrusted data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcecyber.gc.ca
Open sourcecisa.gov
Open sourcethecyberexpress.com
Open sourceptc.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PTC Windchill PDMLink and FlexPLM are facing active exploitation of **`CVE-2026-4681`**, a critical remote code execution flaw caused by deserialization of untrusted data. Splunk published detection guidance describing suspicious HTTP patterns tied to exploitation, including requests containing `run?c=`, `run?p=`, `.jsp?c=`, and `.jsp?p=`, as well as the indicator `GW_READY_OK`. The activity suggests attackers may deploy staged gateway or JSP components, use the `c=` parameter to run operating system commands such as `whoami`, and abuse the `p=` parameter to read files from affected servers. Defenders are being urged to apply PTC’s mitigation and patching guidance and to hunt for related artifacts across compromised environments. Splunk recommends monitoring Windchill MethodServer `log4j` telemetry, particularly servlet-related loggers, and checking file systems for indicators such as `GW.class`, `payload.bin`, and randomly named `dpr_<8 hex>.jsp` files. A Siemens product advisory was also referenced in the reporting set, indicating broader vendor awareness around the issue and the need for rapid validation of exposure in enterprise environments.
Jun 29, 2026
German police contacted and in some cases visited corporate IT administrators at their homes during the early hours of Sunday morning to warn them about a critical, unpatched deserialization vulnerability in **PTC Windchill** and **FlexPLM**. The flaw, tracked as `CVE-2026-4681` and `WID-SEC-2026-0822`, can enable remote code execution and carries a **CVSS v4 score of 9.3** and a **CVSS v3.1 score of 10**. Authorities said they believed criminal actors were likely to exploit the issue imminently to compromise systems, steal data, and deploy ransomware. The warning effort was coordinated by Germany’s **Federal Criminal Police Office** with state police, including Lower Saxony investigators, to quickly notify affected companies and reduce the risk of serious damage. PTC said it had no confirmed evidence of customer exploitation but released indicators of compromise and urgent mitigation guidance for **Apache** and **IIS** deployments, while advising organizations to disconnect internet-exposed systems if workarounds could not be applied quickly.
Jun 29, 2026
CISA added two newly exploited flaws to its Known Exploited Vulnerabilities catalog: **CVE-2026-12569** in **PTC Windchill and FlexPLM** and **CVE-2026-20230** in **Cisco Unified Communications Manager** and **Unified CM SME**. The PTC issue is a critical unauthenticated remote code execution flaw tied to improper input validation or deserialization, affecting multiple Windchill and FlexPLM releases, while the Cisco issue is a critical server-side request forgery vulnerability that can be triggered through crafted HTTP requests when the **WebDialer** service is enabled. CISA set a **June 28** remediation deadline for federal civilian agencies under its binding directive and urged broader review of exposed systems. PTC said **CVE-2026-12569** has now been confirmed exploited in the wild for the first time, with attackers reportedly deploying persistent **JSP webshells** for remote command execution and data exfiltration after sending specially crafted requests. PTC began releasing patches and mitigations earlier and later published indicators of compromise, while German police also warned organizations of imminent attacks. Cisco warned that public proof-of-concept code exists for **CVE-2026-20230** and that successful exploitation could let attackers interact with internal services, write files to the underlying operating system, and potentially escalate privileges to **root**, raising concern for enterprises that rely on these communications and product lifecycle management platforms.
Jul 24, 2026