- PTC released a patch for a new remote code execution flaw in Windchill and FlexPLM, tracked as CVE-2026-126325 with a CVSS v4 score of 9.2.
- PTC's advisory shows attackers changing web shell names across updates, so fixed lists of bad files miss new ones.
- Self-hosted customers should patch, then search logs and servers for web shells, because PTC says new ones may appear at any time.
A patch is a starting line, not a finish
A patch notice can read as "resolved." PTC's own advisory for its Windchill and FlexPLM software tells a less comfortable story. Windchill and FlexPLM are the systems many manufacturers use to manage product design data and product life cycles. Read in full, the advisory is less a notice than a running log of an incident.
The lesson here is that a patch closes a door. It does not tell you who already walked through it.
What PTC announced
PTC says a new security patch is available for a critical flaw in both products. Its advisory names the patched flaw as CVE-2026-126325. The Hacker News gives it a score of 9.2 on the CVSS v4 scale, which tops out at 10.0.
The flaw is a mix of weak checking of incoming data and unsafe handling of that data. According to The Hacker News, a crafted request could let an attacker run code on the server from afar.
PTC says a Windchill administrator should apply the patch. If PTC hosts your environment, PTC says it has already applied the patches and you need take no action. Self-hosted customers are urged to patch as soon as possible.
One caution on identifiers. PTC's page carries several CVE numbers across its updates: CVE-2026-12569, CVE-2026-126325, and CVE-2026-77645 for remote code execution plus CVE-2026-77646 for a server-side request forgery flaw. PTC does not map them neatly on that page. Confirm which ones apply to your versions in PTC's support articles CS473270 and CS483249.
How the flaw works
Deserialization is how software rebuilds an object from data sent to it. If the software trusts that data, an attacker can craft input that makes the server run the attacker's code. PTC's advisory lists this class of weakness as CWE-502, deserialization of untrusted data.
PTC also describes an earlier workaround involving a Java serialization filter tied to a component named com.ptc.wpcfg.logic.ExpressionClassMethod. PTC says it updated its support article about the workaround's possible functional impact.
The attackers keep changing the names
The advisory's history matters more than the new patch. PTC lists indicators of compromise shared on 6/18, 6/25, 7/1, 7/8 and 7/9/2026. It says attackers place persistent JSP web shells in the Windchill login directory. A web shell is a small file that gives an intruder remote control of the server.
PTC documents three naming patterns for these files. First came 16 lowercase hexadecimal characters. Later came six hexadecimal characters, sometimes followed by commands such as ?cmd=whoami. A third used "dpr" plus eight characters.
PTC warns that the attacker may plant more shells under names nobody has listed yet. That is why a list of known bad filenames goes stale. PTC's own advice is to hunt by behavior. It says legitimate Windchill traffic does not POST to /Windchill/login/*.jsp. It flags a request header, X-windchill-req, as having no legitimate use in Windchill. It also tells teams to look for a file named flst.txt, which it says confirms attacker file listing, and for multi-megabyte POST responses from JSP files.
For FlexPLM, PTC describes a probe that precedes web shell deployment: a request for a WSDL description file under /Windchill/rfa/jsp/login/.
Why this product draws attention
The Hacker News places the new disclosure almost five months after an earlier Windchill and FlexPLM flaw, CVE-2026-12569, which it rates 9.3, came under active exploitation. The outlet also says that in July 2026 attackers tied to the Cl0p ransomware group were using that earlier flaw in a data extortion campaign. That campaign was designed to drop JSP web shells and steal product data from manufacturers and industrial firms.
Yordan Ganchev of watchTowr told The Hacker News that PTC software is "a textbook target" for initial access brokers and ransomware operators. He pointed to downtime costs in manufacturing, logistics and fulfillment.
The sources do not say the new flaw has been exploited. They do show that attackers have already targeted this product family. PTC's indicator lists and the Cl0p reporting describe the same flaw family, but they are separate sources, and PTC does not tie its dated lists to Cl0p by name.
Our inference is this. Because a web shell is a file on disk, patching the original flaw would not by itself remove one already planted. The sources do not state this directly.
Questions to put to your team
Ask whether Windchill or FlexPLM is hosted by PTC or by you. That answer decides who has already applied the patch.
If you host it, ask three things. Which version are we running, and is the matching patch installed? Has anyone searched logs and disk for the web shell patterns above, including the earlier indicators from June and July? Is the Windchill login endpoint reachable from the internet, and does it need to be? PTC recommends restricting that exposure where operationally possible.
The question to ask is not only "are we patched?" but "how would we know if we were already entered?" A web shell is a file, so a patch does not by itself remove one already in place.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: PTC.
