Loading story…
PTC Windchill PDMLink and FlexPLM are facing active exploitation of CVE-2026-4681, a critical remote code execution flaw caused by deserialization of untrusted data. Splunk published detection guidance describing suspicious HTTP patterns tied to exploitation, including requests containing run?c=, run?p=, .jsp?c=, and .jsp?p=, as well as the indicator GW_READY_OK. The activity suggests attackers may deploy staged gateway or JSP components, use the c= parameter to run operating system commands such as whoami, and abuse the p= parameter to read files from affected servers.
Defenders are being urged to apply PTC’s mitigation and patching guidance and to hunt for related artifacts across compromised environments. Splunk recommends monitoring Windchill MethodServer log4j telemetry, particularly servlet-related loggers, and checking file systems for indicators such as GW.class, payload.bin, and randomly named dpr_<8 hex>.jsp files. A Siemens product advisory was also referenced in the reporting set, indicating broader vendor awareness around the issue and the need for rapid validation of exposure in enterprise environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-14, Splunk published an analytics story covering exploitation activity related to CVE-2026-4681 in PTC Windchill PDMLink and FlexPLM. The guidance described suspicious HTTP request patterns, indicators such as GW_READY_OK, attacker use of c= and p= parameters, and recommended correlating detections with PTC mitigation, patching, and IOC checks.
Siemens issued product advisory SSA-661247 related to the story context. The reference does not provide a publication date or additional event details in the supplied content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PTC disclosed **CVE-2026-4681**, a critical deserialization flaw in **Windchill PDMLink** and **FlexPLM** that can allow **remote code execution**. The vulnerability affects multiple major release branches, including **11.x, 12.x, and 13.x**, with impacted builds including CPS releases before **11.0 M030**. PTC rated the issue **CVSS v3.1 10.0** and **CVSS v4 9.3**, and said the risk is highest for **publicly accessible instances**. PTC said it has **no evidence of active exploitation affecting customers** at this time, but issued urgent mitigation guidance while patches are pending. The company advised administrators to apply protections in **Apache HTTP Server** and **Microsoft IIS**, extend the same controls to **File Server** and **Replica Server** deployments, and disconnect exposed systems or shut services down if mitigations cannot be applied. PTC also published **indicators of compromise**, including suspicious HTTP request patterns, a specific Chrome user-agent string, malicious filenames, a `payload.bin` SHA-256 hash, and related log messages; for **PTC cloud-hosted** customers, the Apache workaround has already been deployed.
Jun 30, 2026
German police contacted and in some cases visited corporate IT administrators at their homes during the early hours of Sunday morning to warn them about a critical, unpatched deserialization vulnerability in **PTC Windchill** and **FlexPLM**. The flaw, tracked as `CVE-2026-4681` and `WID-SEC-2026-0822`, can enable remote code execution and carries a **CVSS v4 score of 9.3** and a **CVSS v3.1 score of 10**. Authorities said they believed criminal actors were likely to exploit the issue imminently to compromise systems, steal data, and deploy ransomware. The warning effort was coordinated by Germany’s **Federal Criminal Police Office** with state police, including Lower Saxony investigators, to quickly notify affected companies and reduce the risk of serious damage. PTC said it had no confirmed evidence of customer exploitation but released indicators of compromise and urgent mitigation guidance for **Apache** and **IIS** deployments, while advising organizations to disconnect internet-exposed systems if workarounds could not be applied quickly.
Jun 29, 2026
CISA added two newly exploited flaws to its Known Exploited Vulnerabilities catalog: **CVE-2026-12569** in **PTC Windchill and FlexPLM** and **CVE-2026-20230** in **Cisco Unified Communications Manager** and **Unified CM SME**. The PTC issue is a critical unauthenticated remote code execution flaw tied to improper input validation or deserialization, affecting multiple Windchill and FlexPLM releases, while the Cisco issue is a critical server-side request forgery vulnerability that can be triggered through crafted HTTP requests when the **WebDialer** service is enabled. CISA set a **June 28** remediation deadline for federal civilian agencies under its binding directive and urged broader review of exposed systems. PTC said **CVE-2026-12569** has now been confirmed exploited in the wild for the first time, with attackers reportedly deploying persistent **JSP webshells** for remote command execution and data exfiltration after sending specially crafted requests. PTC began releasing patches and mitigations earlier and later published indicators of compromise, while German police also warned organizations of imminent attacks. Cisco warned that public proof-of-concept code exists for **CVE-2026-20230** and that successful exploitation could let attackers interact with internal services, write files to the underlying operating system, and potentially escalate privileges to **root**, raising concern for enterprises that rely on these communications and product lifecycle management platforms.
Jul 24, 2026