PTC warns of imminent attacks on critical Windchill and FlexPLM RCE flaw CVE-2026-4681

In late March 2026, PTC warned customers of a critical remote code execution flaw in its Windchill and FlexPLM product lifecycle management (PLM) software, CVE-2026-4681. It said there was credible evidence of an imminent threat from a third-party group. No patch was available at first, and in Germany police officers visited companies, some in the middle of the night, to deliver the warning in person. If you run, integrate with or host Windchill, the servlet-blocking workaround below is the first thing to check.

What happened

PTC's advisory describes unsafe deserialization of untrusted data that can lead to remote code execution. It is rated CVSS 10.0. PTC told customers in an email that it had no evidence of exploitation against its customers, but that it had credible information about an imminent threat. It published indicators of compromise and an Apache/IIS rule to block the vulnerable servlet paths while it worked on patches for all supported releases.

According to Heise, as reported by BleepingComputer, Germany's Federal Criminal Police Office (BKA) alerted state police (LKA) offices, which sent officers over a weekend to hand affected companies PTC's notice. Some of the companies don't even use the products. PLM systems hold design data for manufacturing, defense and supply chains, which explains the unusual national-security response. CISA published ICS advisory ICSA-26-085-03, and Germany's BSI also issued a warning.

Kudelski Security's advisory names the attack surface as two publishing servlets:

• /servlet/WindchillGW/com.ptc.wvs.server.publish.Publish
• /servlet/WindchillAuthGW/com.ptc.wvs.server.publish.Publish

Later context: in June 2026 PTC patched a different Windchill/FlexPLM deserialization flaw, CVE-2026-12569 (CVSS 9.3). That one was exploited in the wild to drop JSP webshells, added to CISA's KEV catalog, and reportedly used by the Clop extortion gang in July. As of that reporting there was no public confirmation that CVE-2026-4681 itself had been exploited.

Who is affected

• Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0 and 13.1.0.0 through 13.1.3.0, including all critical patch sets (CPS).
• FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0 through 12.1.3.0, 13.0.2.0 and 13.0.3.0.
• Releases before 11.0 M030 are also affected and may need different workarounds.
• Internal-only instances, file servers and replica servers are affected too, not just internet-facing ones.

What it means for developers and engineering teams

This is another case of a Java enterprise application deserializing data from an HTTP endpoint, the same class of bug as Cisco's FMC flaw the same month. The publishing servlet is a background feature for visualization and publishing jobs. Few administrators think of it as an exposed API, yet it is reachable from the same web front end as the main application. Attack surface includes the endpoints you forgot you had, not only the login page.

The IoCs show the attack sequence. GW.class and payload.bin are staged first. A dpr_<8 hex>.jsp file is a JSP webshell. Requests matching run?p= or .jsp?c= are the shell being used. PTC says that finding GW.class or a dpr_ file means the attacker had already prepared the exploit before attempting RCE. Teams that build integrations into PLM systems (CAD connectors, ERP sync, MES feeds) should know their service accounts and API tokens are exposed if the server is compromised.

What to do now

1. Apply PTC's patch for your release if it is available. Otherwise apply the servlet block right away on every Windchill, FlexPLM, file and replica server.
2. Apache: add a file under conf/conf.d/ with a <LocationMatch> for the two .../com.ptc.wvs.server.publish.Publish paths containing Require all denied, then restart Apache.
3. IIS: add a URL Rewrite rule in <WT_HOME>\web.config that returns 403 for the same paths, then restart IIS.
4. If you can't do either, take the instance off the internet or shut the service down, as PTC advises.
5. Hunt for GW.class, payload.bin, Gen.class, HTTPRequest.class, WTContextUpdate.class and dpr_*.jsp files. Grep logs for GW_READY_OK, ClassNotFoundException referencing GW, and "HTTP Gateway Exception".
6. Also patch CVE-2026-12569 if you haven't. It is the Windchill flaw known to be exploited.
7. Rotate integration credentials stored on or used by the PLM server if you find any IoC.

Related on TechLogHub

• Nginx vs Apache
• Middleware

Sources

• BleepingComputer: PTC warns of imminent threat from critical Windchill, FlexPLM RCE bug
• Kudelski Security: Critical RCE vulnerability in Windchill and FlexPLM
• Security Affairs: CISA and BSI warn orgs of critical PTC Windchill and FlexPLM flaw
• SecurityWeek: CISA flags critical PTC vulnerability that had German police mobilized
• BleepingComputer: Clop targets Windchill, FlexPLM in data theft attacks (CVE-2026-12569)