CVE-2026-12569 Windchill/FlexPLM Deserialization RCE via ExpressionClassMethod

Ethan Andrews@eandrews

•updated Jul 28, 2026•4•0•17

Detects exploitation of the CVE-2026-12569 Java deserialization vulnerability in PTC Windchill and FlexPLM. The detection triggers when the specific payload class 'com.ptc.wpcfg.logic.ExpressionClassMethod' is identified within command-line arguments of Java-based processes, indicating an attempt to achieve remote code execution through the application's deserialization flaw.