Critical PTC Windchill and FlexPLM Deserialization RCE Actively Exploited

PTC has released remediation steps and version-specific patches for the affected Windchill and FlexPLM releases. Apply the appropriate patch for your version without delay using the official eSupport article (CS473270), and treat this as an emergency, out-of-cycle update given confirmed active exploitation. For PTC-hosted instances, confirm directly with PTC that remediation has been completed on your behalf.

Search the Windchill login directory for JSP files named with a 16-character lowercase hexadecimal pattern, as the attacker names webshells using this convention and new shells may be deployed under different names. Hash-check any suspicious JSP files against the known webshell SHA256, and check for the presence of flst.txt in temporary or Windchill working directories, as its presence confirms attacker file-listing activity. Treat any internet-exposed instance running an affected version as potentially compromised until proven otherwise.

Block the documented command-and-control and indicator IP addresses at the perimeter firewall, prioritizing the primary C2 address. Treat the indicator list as non-exhaustive and continue monitoring, since the vendor notes additional infrastructure may be in use beyond what has been published.

Add WAF or IDS rules to block any request containing the custom X-windchill-req header, which has no legitimate use in Windchill, and alert on any HTTP POST to the hex-named JSP webshell pattern under the login path, as legitimate Windchill traffic does not POST to this location. Additionally, alert on large multi-megabyte POST responses originating from JSP files in the Windchill application tier and on the WSDL probe pattern against FlexPLM login JSP resources that precedes exploitation.

Restrict internet exposure of the Windchill and FlexPLM login endpoints wherever operationally feasible, placing the application behind a VPN, reverse proxy, or access controls so that the vulnerable endpoint is not directly reachable from untrusted networks. Reducing attack surface limits exposure to both this vulnerability and future flaws in the same components.

Maintain an accurate inventory of Windchill, FlexPLM, and CPS deployments and their versions, subscribe to PTC's eSupport notifications for ongoing updates on this active situation, and establish a patch cadence that allows rapid emergency deployment for actively exploited, critical vulnerabilities. Evaluate the security posture of internet-facing enterprise applications and third-party platforms on a recurring basis to reduce exposure to high-severity, network-reachable flaws.