CVE-2026-126325: PTC Windchill and FlexPLM Unauthenticated RCE — Detection and Remediation Guide

---
title: Windchill or Servlet Engine Java Process Spawning Shell or Scripting Interpreter
id: 3f8a1c42-7b9d-4e21-9c63-5d1a2b8f7e90
status: experimental
description: Detects the Windchill/FlexPLM Java or Tomcat process spawning command shells, scripting engines, or reconnaissance utilities — a high-fidelity indicator of successful deserialization-based code execution such as CVE-2026-126325.
references:
  - https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\tomcat.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\nltest.exe'
      - '\net.exe'
      - '\curl.exe'
  filter_windchill_path:
    ParentImage|contains:
      - '\ptc\'
      - '\Windchill\'
  condition: selection_parent and selection_child and filter_windchill_path
falsepositives:
  - Rare — Windchill administrative scripts legitimately invoked by the method server; tune on confirmed baseline activity
level: critical
---
title: Java Serialized Object Signature in HTTP Request Bodies to PLM Servers
id: 91c4e7a2-3d60-4b48-a5f1-2e9c6b7d8a34
status: experimental
description: Detects inbound HTTP requests containing the base64 Java serialization magic bytes (rO0AB) directed at Windchill/FlexPLM application servers, indicating attempted delivery of a malicious serialized object consistent with CVE-2026-126325 exploitation.
references:
  - https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/Windchill/'
      - '/servlet/'
  selection_method:
    cs-method: 'POST'
  selection_payload:
    cs-body|contains:
      - 'rO0AB'
      - 'ACEDAAU'
      - 'aced0005'
  condition: selection_uri and selection_method and selection_payload
falsepositives:
  - Legitimate Java RMI or applet-based integrations using serialized objects; validate against known-good Windchill client traffic before raising severity
level: high
---
title: PLM Application Server JVM Initiating Outbound Network Connection
id: 6b2d9f14-8e53-4a77-b6c2-4f1d8a3c9e56
status: experimental
description: Detects the Windchill/FlexPLM Java process making outbound network connections to non-internal destinations — consistent with command-and-control, payload retrieval, or data staging following exploitation of CVE-2026-126325.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\java.exe'
      - '\javaw.exe'
  filter_install_path:
    Image|contains:
      - '\ptc\'
      - '\Windchill\'
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '172.30.'
      - '172.31.'
  condition: selection and filter_install_path and not filter_internal
falsepositives:
  - PTC licensing or telemetry endpoints; whitelist known vendor destinations after validation
level: high

// Hunt: Windchill/FlexPLM JVM spawning shells, script interpreters, or recon tooling
// Scope to your PLM server hosts via the device list; extend Lookback during IR.
let PLMHosts = dynamic(["WINDCHILL-APP01", "WINDCHILL-APP02", "FLEXPLM-APP01"]); // replace with your server names
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "whoami.exe", "nltest.exe", "net.exe", "curl.exe", "tar.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where DeviceName in~ (PLMHosts)
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe", "tomcat.exe")
   or InitiatingProcessFolderPath has_any ("ptc", "Windchill", "Tomcat")
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, SHA256, ReportId
| order by TimeGenerated desc;

// Hunt: Inbound requests carrying Java serialization fingerprints to PLM servers (via proxy/WAF CEF ingestion)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DeviceVendor in~ ("Apache", "F5", "Zscaler", "Microsoft", "NGINX") or DeviceProduct has_any ("proxy", "waf", "iis")
| where RequestMethod =~ "POST"
| where RequestURL has_any ("/Windchill/", "/servlet/", "FlexPLM")
| where AdditionalExtensions has_any ("rO0AB", "aced0005") or Message has_any ("rO0AB", "aced0005")
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, DeviceProduct, Message
| order by TimeGenerated desc;

// Hunt: Unusual outbound connections from PLM server JVM processes (egress / C2 detection)
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where DeviceName in~ (PLMHosts)
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe")
| where not(RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172.16.")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
          by DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessCommandLine
| order by ConnectionCount desc;

-- Artifact: Windchill_Deserialization_Hunt
-- Purpose: Identify suspicious child processes of the PLM JVM and unexpected
-- outbound connections from Windchill/FlexPLM servers (CVE-2026-126325 IR triage)

-- Pass 1: Suspicious child processes spawned by java/javaw/tomcat
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|whoami|nltest|curl|wget|bash|sh$'
  AND Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ '(?i)java|javaw|tomcat'
  )

-- Pass 2: Outbound connections from the JVM to external addresses
SELECT Pid, Name, Laddr, Raddr, Status
FROM netstat()
WHERE Name =~ '(?i)java|javaw'
  AND Status =~ 'ESTABLISHED'
  AND NOT Raddr.IP =~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.|0\.0\.0\.0)'

-- Pass 3: Recently dropped executable/script files in servlet webroot and temp paths
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/ptc/Windchill/**/*.jsp',
  'C:/ptc/Windchill/**/webapps/**/*.jsp',
  'C:/Windows/Temp/*.jsp',
  'C:/Windows/Temp/*.exe',
  '/opt/ptc/Windchill/**/*.jsp',
  '/tmp/*.jar',
  '/tmp/*.sh'
])
WHERE Mtime > now() - 2592000  -- last 30 days

#!/usr/bin/env bash
# CVE-2026-126325 - Windchill/FlexPLM patch verification and compromise triage (Linux)
# Run on the Windchill application server as root or the Windchill service account owner.

set -euo pipefail

WINDCHILL_HOME="${WINDCHILL_HOME:-/opt/ptc/Windchill}"
REPORT="/tmp/cve-2026-126325_triage_$(date +%Y%m%d_%H%M%S).txt"

echo "=== CVE-2026-126325 Triage Report — $(hostname) — $(date) ===" | tee "$REPORT"

# 1. Capture installed Windchill version and patch level for comparison against the PTC advisory
echo -e "\n[1] Windchill version / patch level:" | tee -a "$REPORT"
if [ -d "$WINDCHILL_HOME" ]; then
  find "$WINDCHILL_HOME" -maxdepth 2 -iname "*version*" -o -iname "*.properties" 2>/dev/null | head -20 | tee -a "$REPORT"
  grep -rhi "wt.version\|build.label\|patch.level" "$WINDCHILL_HOME"/codebase/WEB-INF 2>/dev/null | head -10 | tee -a "$REPORT" || true
else
  echo "WINDCHILL_HOME not found at $WINDCHILL_HOME — set WINDCHILL_HOME and re-run." | tee -a "$REPORT"
fi

# 2. Enumerate running JVM processes bound to Windchill and their open listeners
echo -e "\n[2] Running Java processes and listeners:" | tee -a "$REPORT"
ps -eo pid,ppid,user,cmd | grep -i "[j]ava" | tee -a "$REPORT"
ss -tlnp 2>/dev/null | grep -i java | tee -a "$REPORT" || true

# 3. IOC check: shells or tools spawned by the JVM (retrospective via process accounting if enabled)
echo -e "\n[3] Suspicious children of JVM (current snapshot):" | tee -a "$REPORT"
for jpid in $(pgrep -f "java"); do
  ps --ppid "$jpid" -o pid,ppid,user,cmd 2>/dev/null | grep -Ei "bash|sh |curl|wget|nc |python|perl" | tee -a "$REPORT" || true
done

# 4. IOC check: recent web shells dropped into servlet webroot / temp
echo -e "\n[4] Recently modified JSP/script files (last 30 days):" | tee -a "$REPORT"
find "$WINDCHILL_HOME" /tmp /var/tmp -type f \( -iname "*.jsp" -o -iname "*.sh" -o -iname "*.jar" \) -mtime -30 2>/dev/null | tee -a "$REPORT"

# 5. Outbound egress from the JVM — PLM servers should have near-zero internet egress
echo -e "\n[5] Established outbound connections from Java:" | tee -a "$REPORT"
ss -tnp 2>/dev/null | grep -i java | grep -vE "10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\." | tee -a "$REPORT" || true

# 6. Egress hardening: block JVM outbound internet access pending patch (review before applying)
echo -e "\n[6] OPTIONAL egress lockdown commands (review, then execute manually):" | tee -a "$REPORT"
{
  echo "iptables -A OUTPUT -m owner --uid-owner <windchill_svc_user> -d 10.0.0.0/8 -j ACCEPT"
  echo "iptables -A OUTPUT -m owner --uid-owner <windchill_svc_user> -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT"
  echo "iptables -A OUTPUT -m owner --uid-owner <windchill_svc_user> -j DROP"
} | tee -a "$REPORT"

echo -e "\n=== Triage complete. Compare version output to the PTC advisory and investigate any hits in sections 3-5. Report: $REPORT ==="