CVE-2026-12569: PTC Windchill Exploitation — Detection and Remediation Guide

---
title: Potential CVE-2026-12569 Exploitation - Java Spawning Shell
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects the Windchill Java process spawning cmd.exe or powershell.exe, indicative of RCE exploitation.
references:
 - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.initial_access
 - attack.execution
 - attack.t1190
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith:
     - '\java.exe'
     - '\jsvc.exe'
     - '\tomcat.exe'
   Image|endswith:
     - '\cmd.exe'
     - '\powershell.exe'
     - '\pwsh.exe'
 condition: selection
falsepositives:
 - Legitimate administrative debugging by vendor support
level: critical
---
title: PTC Windchill Webshell Creation Pattern
id: b1c2d3e4-f5a6-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects creation of common webshell files in Windchill web directories potentially related to CVE-2026-12569.
references:
 - https://www.securityweek.com/first-ever-exploitation-of-ptc-windchill-vulnerability-discovered-in-the-wild/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.persistence
 - attack.t1505.003
logsource:
 category: file_creation
 product: windows
detection:
 selection:
   TargetFilename|contains:
     - '\Windchill\'
     - '\Tomcat\webapps\'
   TargetFilename|endswith:
     - '.jsp'
     - '.jspx'
     - '.ashx'
 condition: selection
falsepositives:
 - Authorized software updates or plugin installations
level: high

// Hunt for Java processes spawning shells on Windchill servers
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in ("java.exe", "jsvc.exe", "tomcat.exe") 
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe")
| extend AccountCustomEntity = AccountName, HostCustomEntity = DeviceName, ProcessCustomEntity = FileName
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FileName, FolderPath

-- Hunt for suspicious parent-child process relationships on Linux/Windows endpoints
SELECT Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.Cmdline AS ParentCmd,
       Pid, Name, Cmdline, Username
FROM pslist()
WHERE Parent.Name =~ "java"
  AND Name IN ("cmd", "powershell", "pwsh", "sh", "bash")

# PowerShell script to audit Windchill servers for exploitation indicators of CVE-2026-12569
# Requires Administrative Privileges

Write-Host "[*] Starting Audit for PTC Windchill RCE Indicators (CVE-2026-12569)..." -ForegroundColor Cyan

# Check for suspicious process chains
$suspiciousProcesses = Get-WmiObject Win32_Process | Where-Object { 
    $_.Name -in @('cmd.exe', 'powershell.exe', 'pwsh.exe') -and 
    (Get-WmiObject Win32_Process -Filter "ProcessId = $($_.ParentProcessId)").Name -in @('java.exe', 'jsvc.exe', 'tomcat.exe') 
}

if ($suspiciousProcesses) {
    Write-Host "[!] ALERT: Suspicious process chain detected! Java parent spawning shell." -ForegroundColor Red
    $suspiciousProcesses | Format-List Name, ProcessId, ParentProcessId, CommandLine
} else {
    Write-Host "[+] No suspicious process chains found." -ForegroundColor Green
}

# Check for recent file modifications in web directories (Last 24 hours)
$webPaths = @("C:\PTC\Windchill", "C:\Program Files\Apache\Tomcat")
$cutOffTime = (Get-Date).AddHours(-24)

foreach ($path in $webPaths) {
    if (Test-Path $path) {
        Write-Host "[*] Scanning $path for recent webshell-like modifications..." -ForegroundColor Cyan
        Get-ChildItem -Path $path -Recurse -Include *.jsp,*.jspx,*.ashx,*.php -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt $cutOffTime } | 
        ForEach-Object { 
            Write-Host "[!] WARNING: Recent file drop detected: $($_.FullName) (Modified: $($_.LastWriteTime))" -ForegroundColor Yellow 
        }
    }
}

Write-Host "[*] Audit Complete. If alerts were triggered, initiate Incident Response procedures immediately." -ForegroundColor Cyan