The patch for CVE-2026-12569 was released on 15 June 2026
Assessment
The date appears in the BSI's warning email of 17 June, reproduced by heise from a whistleblower: "the patch released on 06/15/2026 represents a secured version of the software." PTC's public Trust Center changelog begins at 2:16 PM ET on 17 June with "remediation steps now available," and its first dated patch entries are 18 June. The eSupport article CS473270, where PTC posts patch downloads, is behind a customer login and may carry the earlier date. The BSI's statement is a primary source for what the BSI was told; PTC has not publicly confirmed a 15 June release.
Where this claim appeared
heise online · 2026-06-19
https://www.heise.de/en/news/PTC-Windchill-BSI-calls-admins-at-night-due-to-critical-security-vulnerability-11338329.htmlWhat “Weak Evidence” means
Evidence exists but is thin, circumstantial, or explicitly qualified as weak by the source that published it. Shared hosting infrastructure between threat clusters is the recurring example.
3 of 5 · rating scale
Assessed in
Cl0p and PTC Windchill: The Custom Implant That Turned Engineering Vaults Into an Extortion CampaignThink this assessment is wrong? Report an error.