This vulnerability (CVE-2026-12569) in PTC Windchill PDMLink and FlexPLM involves improper input validation (CWE-20) and unsafe deserialization (CWE-502) of untrusted data, which can be exploited remotely without authentication to achieve remote code execution. It affects all CPS versions and Windchill/FlexPLM releases prior to 11.0 M030, as well as specific later versions enumerated. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, but with high impact on confidentiality, integrity, and availability. The vendor has not yet provided a remediation level or patch information.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on affected systems, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability with high severity. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to affected systems and monitor for unusual activity related to deserialization processes. Avoid processing untrusted data where possible.