Loading story…
German police contacted and in some cases visited corporate IT administrators at their homes during the early hours of Sunday morning to warn them about a critical, unpatched deserialization vulnerability in PTC Windchill and FlexPLM. The flaw, tracked as CVE-2026-4681 and WID-SEC-2026-0822, can enable remote code execution and carries a CVSS v4 score of 9.3 and a CVSS v3.1 score of 10. Authorities said they believed criminal actors were likely to exploit the issue imminently to compromise systems, steal data, and deploy ransomware.
The warning effort was coordinated by Germany’s Federal Criminal Police Office with state police, including Lower Saxony investigators, to quickly notify affected companies and reduce the risk of serious damage. PTC said it had no confirmed evidence of customer exploitation but released indicators of compromise and urgent mitigation guidance for Apache and IIS deployments, while advising organizations to disconnect internet-exposed systems if workarounds could not be applied quickly.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
PTC disclosed CVE-2026-4681 / WID-SEC-2026-0822, an unpatched deserialization vulnerability in Windchill and FlexPLM that can enable remote code execution. The company said it had no confirmed evidence of customer exploitation, published indicators of compromise, and urged immediate mitigations or disconnection of internet-exposed systems.
During the early hours of Sunday morning, German police contacted and in some cases visited corporate IT administrators at home to warn them about the critical PTC vulnerability. The outreach was coordinated by the Federal Criminal Police Office and state police after authorities assessed that criminal actors were likely to exploit the flaw imminently for data theft and ransomware deployment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceheise.de
Open sourceborncity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PTC disclosed **CVE-2026-4681**, a critical deserialization flaw in **Windchill PDMLink** and **FlexPLM** that can allow **remote code execution**. The vulnerability affects multiple major release branches, including **11.x, 12.x, and 13.x**, with impacted builds including CPS releases before **11.0 M030**. PTC rated the issue **CVSS v3.1 10.0** and **CVSS v4 9.3**, and said the risk is highest for **publicly accessible instances**. PTC said it has **no evidence of active exploitation affecting customers** at this time, but issued urgent mitigation guidance while patches are pending. The company advised administrators to apply protections in **Apache HTTP Server** and **Microsoft IIS**, extend the same controls to **File Server** and **Replica Server** deployments, and disconnect exposed systems or shut services down if mitigations cannot be applied. PTC also published **indicators of compromise**, including suspicious HTTP request patterns, a specific Chrome user-agent string, malicious filenames, a `payload.bin` SHA-256 hash, and related log messages; for **PTC cloud-hosted** customers, the Apache workaround has already been deployed.
Jun 30, 2026
PTC Windchill PDMLink and FlexPLM are facing active exploitation of **`CVE-2026-4681`**, a critical remote code execution flaw caused by deserialization of untrusted data. Splunk published detection guidance describing suspicious HTTP patterns tied to exploitation, including requests containing `run?c=`, `run?p=`, `.jsp?c=`, and `.jsp?p=`, as well as the indicator `GW_READY_OK`. The activity suggests attackers may deploy staged gateway or JSP components, use the `c=` parameter to run operating system commands such as `whoami`, and abuse the `p=` parameter to read files from affected servers. Defenders are being urged to apply PTC’s mitigation and patching guidance and to hunt for related artifacts across compromised environments. Splunk recommends monitoring Windchill MethodServer `log4j` telemetry, particularly servlet-related loggers, and checking file systems for indicators such as `GW.class`, `payload.bin`, and randomly named `dpr_<8 hex>.jsp` files. A Siemens product advisory was also referenced in the reporting set, indicating broader vendor awareness around the issue and the need for rapid validation of exposure in enterprise environments.
Jun 29, 2026
CISA added two newly exploited flaws to its Known Exploited Vulnerabilities catalog: **CVE-2026-12569** in **PTC Windchill and FlexPLM** and **CVE-2026-20230** in **Cisco Unified Communications Manager** and **Unified CM SME**. The PTC issue is a critical unauthenticated remote code execution flaw tied to improper input validation or deserialization, affecting multiple Windchill and FlexPLM releases, while the Cisco issue is a critical server-side request forgery vulnerability that can be triggered through crafted HTTP requests when the **WebDialer** service is enabled. CISA set a **June 28** remediation deadline for federal civilian agencies under its binding directive and urged broader review of exposed systems. PTC said **CVE-2026-12569** has now been confirmed exploited in the wild for the first time, with attackers reportedly deploying persistent **JSP webshells** for remote command execution and data exfiltration after sending specially crafted requests. PTC began releasing patches and mitigations earlier and later published indicators of compromise, while German police also warned organizations of imminent attacks. Cisco warned that public proof-of-concept code exists for **CVE-2026-20230** and that successful exploitation could let attackers interact with internal services, write files to the underlying operating system, and potentially escalate privileges to **root**, raising concern for enterprises that rely on these communications and product lifecycle management platforms.
Jul 24, 2026