RCE in PTC Windchill PDMlink and PTC FlexPLM

Successful exploitation allows arbitrary code execution on vulnerable Windchill or FlexPLM servers. Reported in-the-wild activity includes deployment of JSP web shells, enabling persistent remote access, remote command execution, and potential data exfiltration. Given the network-reachable, unauthenticated nature of the flaw and the high confidentiality, integrity, and availability impact described in the source material, compromise can result in full application-server takeover and follow-on intrusion activity.

Where immediate patching is not possible, reduce exposure of the Windchill login endpoint from the internet where operationally feasible. PTC-published defensive guidance in the provided content includes blocking the known attacker C2 IP 5.180.41.35 at the perimeter, reviewing HTTP access logs for suspicious POST requests to /Windchill/login/*.jsp, scanning for JSP web shells matching /Windchill/login/[0-9a-f]{16}.jsp, checking suspicious files against the provided hash 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c, looking for flst.txt in /tmp or the Windchill working directory, and deploying a WAF/IDS rule to block requests containing the header X-windchill-req:. These are mitigations and detection measures only; patching remains the primary fix.

Apply PTC’s vendor-issued security patches and update affected products to fixed releases. The provided advisory content indicates that Windchill and FlexPLM releases prior to 11.0 M030 are affected, so organizations should upgrade to 11.0 M030 or later and ensure applicable CPS updates are installed across all impacted deployments. Because active exploitation has been reported, remediation should be prioritized and systems should be assessed for compromise before or alongside patching.