RCE in PTC Windchill PDMlink and PTC FlexPLM

Successful exploitation allows arbitrary code execution on vulnerable Windchill or FlexPLM servers. Reporting on active exploitation indicates attackers have used the flaw to deploy JSP web shells on compromised systems, enabling persistent remote access, follow-on command execution, and likely data access or exfiltration. Given the network-reachable, unauthenticated nature described in the supporting content and the high confidentiality, integrity, and availability impacts, compromise can result in full application-server takeover and broader enterprise risk.

If patching cannot be completed immediately, implement vendor-recommended defensive measures from the provided reporting: restrict or remove internet exposure of the Windchill login endpoint where operationally possible; add WAF or IDS rules to block requests containing the header X-windchill-req:; block the reported attacker C2 IP 5.180.41.35 at the perimeter; review HTTP access logs for suspicious POST requests to /Windchill/login/*.jsp; scan for JSP files matching /Windchill/login/[0-9a-f]{16}.jsp; hash-check suspicious JSP files against 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c; and investigate the presence of flst.txt in /tmp or the Windchill working directory as evidence of attacker file-listing activity. These are mitigations only and do not replace patching.

Apply PTC security updates immediately. The provided content states the vulnerability affects all CPS versions and Windchill and FlexPLM releases prior to 11.0 M030, and that PTC released patches and urged immediate remediation. Organizations should upgrade to a fixed PTC release or apply the vendor-issued patch for their affected branch, including impacted 11.1, 11.2, 12.0, 12.1, and 13.0 versions where applicable. Because exploitation is active, remediation should be paired with compromise assessment, including review for JSP web shells under /Windchill/login/, suspicious POST requests to /Windchill/login/*.jsp, and related indicators of compromise published by PTC.