https://www.heise.de/en/news/WTF-Police-responded-on-Saturday-night-due-to-a-zero-day-11221590.html heise+ entdecken Suchen[ ] heise Plusheise PlusAbo Suchen[ ] * * * * * * Alle Magazine im Browser lesen IT News * Newsticker * Hintergrunde * Ratgeber * Testberichte * Meinungen Online-Magazine * heise+ * Telepolis * heise autos * bestenlisten * tipps+tricks Services * heise shop * heise jobs * heise academy * heise download * heise preisvergleich * Tarifrechner * heise compaliate * Abo bestellen * Mein Abo * Netzwerktools * iMonitor * Loseblattwerke * Spiele Uber uns * heise medien * heise regioconcept * heise business services * SponsoringLogo Hannover 96 * Mediadaten * Karriere * Presse Anzeige * Special: Zusammen das Datacenter weiterentwickeln * Secure IT fur Unternehmen * Newsletter * heise-Bot * Push-Nachrichten ${title} ${title} ${intro} ${title} ${lead} ${title} ${title} ${intro} ${title} ${lead} ${content} heise+ Das Beste aus heise+ Zur heise+ Startseite ${content} heise online Top-Beitrage von heise online Zur heise online Startseite ${content} heise online Most popular articles by heise online ${content} * Newsticker * Security * IT & Tech * Developer * KI * Entertainment * Wissenschaft * Bestenlisten * Digital Health * Foren * Alle Themen[arrow-righ][arrow-righ] Anzeige Special: Zusammen das Datacenter weiterentwickelnSecure IT fur Unternehmen Advertisement WTF WTF: Police responded on Saturday night due to a zero-day Due to the security vulnerability in Windchill and ZeroPLM, police alerted affected companies. Administrators are irritated. listen Print view Police officers on duty to combat zero-days Police officers on duty to combat zero-days. Symbolic image, colored and ironized. (Image: C. Nass / Shutterstock.com / Bearbeitung: heise online) Mar 23, 2026 at 9:36 pm CET 5 min. read Security By * Dr. Christopher Kunz Advertisement Contents 1. WTF: Police responded on Saturday night due to a zero-day + 3:30 AM in Germany + BKA, PTC, BSI ... + Schrodinger's IoC The serious security vulnerability in the products Windchill and FlexPLM prompted police action across Germany over the weekend. At the instigation of the Federal Criminal Police Office (BKA), police officers were deployed nationwide to alert affected companies -- an unprecedented procedure. The administrators, thus disturbed in their weekend, expressed irritation -- some do not even use the vulnerable software. Continue after ad When the editorial office received a tip late Sunday morning about a critical security vulnerability in Windchill and FlexPLM, it sounded like a routine report: a deserialization vulnerability in specialized software, even with a maximum CVSS score of 10, doesn't usually cause a stir at heise security. Apparently, the BKA reacted quite differently: By then, it had already alerted the state criminal investigation offices (LKA) in various federal states, which sent police officers to affected companies during the night. As several readers reported in the forum, police officers were at company and private premises in the middle of the night. Videos by heise mehr Videos * c't 3003 * heise & ct * Peertube 3:30 AM in Germany Their unusual mission: The officers handed over a copy of the letter to the sleepy administrators, which manufacturer PTC had already sent to all customers the day before and which contained instructions for a hotfix. An affected party reports: "The police were at our door at 3:30 AM. A production employee then informed the managing director, who informed me or a colleague." He wonders about the urgency of the action: "Our servers are only accessible internally and cannot communicate with the WAN. The number of authorized clients is also severely restricted (different VLAN)." Another reader received a call around 2:45 AM on Sunday morning, which he initially took as a joke -- until the police rang his doorbell shortly thereafter. And to no avail: Although his company uses PTC products, they are not the ones affected by the security vulnerability. In response to our inquiry, several state criminal investigation offices confirmed the procedure. In a statement, the LKA Thuringia writes: "The Federal Criminal Police Office (BKA) provided the LKA Thuringia with a list of affected companies located in Thuringia. The Central Contact Point for Cybercrime (ZAC) Thuringia then initiated personal contact and attempted to establish telephone contact if personal contact was not made. The goal was to raise awareness and initiate protective measures as quickly as possible. The companies reached had already been informed by PTC Inc. and had taken security measures." BKA, PTC, BSI ... Continue after ad The coordinated and extremely personnel-intensive procedure -- unofficially, over a thousand affected customers in Germany are mentioned -- is very unusual and unique in Germany to date. Especially since neither the federal authority responsible for IT security in Germany, the BSI, nor its US counterpart CISA (Cybersecurity & Infrastructure Security Agency) have issued any particularly loud warnings so far. The BSI published a notice on Monday midday in the Warning and Information Service, while CISA remains silent. Its "Known Exploited Vulnerabilities" list's most recent entry is from March 20th and concerns Apple products. We asked the BKA, the BSI, and manufacturer PTC for a statement on this very unusual procedure. While PTC and the BKA had not yet responded by early Monday afternoon, the BSI commented cautiously. A spokesperson informed us that the evaluation criteria for security vulnerabilities "include in particular the characteristics of the vulnerability itself, but also the prevalence of the product and other -- possibly mitigating -- framework conditions. A decisive factor is the information provided to users by the manufacturer itself. To the best of the BSI's knowledge, the manufacturer has informed all customers." Furthermore, the BSI had informed KRITIS operators separately, the agency spokesperson continued: "This is an advantage of registration with the BSI, also within the scope of NIS2." Schrodinger's IoC Also puzzling is PTC's official stance that they currently have "no evidence of confirmed exploitation affecting PTC customers." Because: Just a few lines below this sentence, apparently intended to reassure customers, PTC lists very specific Indicators of Compromise (IoC), including the presence of a specific class file (GW.class) on attacked systems. If this file is found on a Windchill server, it indicates "that the attacker has successfully weaponized the system before executing Remote Code Execution (RCE)." Schrodinger's IoC: An attacker exists, and malicious code exists on target systems -- yet according to their own statement, no successful attacks have occurred. We have also asked PTC for a statement on this discrepancy. By early Monday afternoon, the manufacturer had not yet released any patches for the security vulnerability, and a CVE ID is still missing from the usual databases. However, this is necessary to ensure inclusion in structured lists, such as Cyber Threat Intelligence (CTI) feeds. Lesen Sie auch A sign with a symbolic update reminder. VMware Tanzu: Various Spring products are attackable heise Security --------------------------------------------------------------------- Network hardware Critical security vulnerability in Citrix Gateway and Netscaler ADC heise Security --------------------------------------------------------------------- A symbolic update bar is filling up. Security patches: Malicious code attacks on Atlassian Bamboo possible heise Security --------------------------------------------------------------------- A symbolic update button on a keyboard. Qnap addresses critical security issues in NAS software heise Security --------------------------------------------------------------------- Highly distorted image of a finger on a keyboard, with a digital exclamation mark in the foreground Zero-day allows code execution in WindChill and FlexPLM heise Security Mehr anzeigenWeniger anzeigen Jetzt heise security PRO entdecken Jetzt heise security PRO entdecken Jetzt heise security PRO entdecken Jetzt heise security PRO entdecken (cku) Don't miss any news - follow us on Facebook, LinkedIn or Mastodon. This article was originally published in German. It was translated with technical assistance and editorially reviewed before publication. Dieser Link ist leider nicht mehr gultig. Links zu verschenkten Artikeln werden ungultig, wenn diese alter als 7 Tage sind oder zu oft aufgerufen wurden. --------------------------------------------------------------------- Sie benotigen ein heise+ Paket, um diesen Artikel zu lesen. Jetzt eine Woche unverbindlich testen - ohne Verpflichtung! Wochenpass bestellen Sie haben heise+ bereits abonniert? Hier anmelden. Oder benotigen Sie mehr Informationen zum heise+ Abo Home Anzeige [svg] [IT-Sec_Weber-bdf8339af62d32fe] Advertisement * Datenaustausch: Schluss mit dem ,,Flickenteppich" * Die unbequeme Wahrheit uber Cloud-Sicherheit * Immer noch Phishing trotz Schulungen - warum? * IT-Souveranitat - ein differenzierter Blick * Themenspecial: Secure IT fur Unternehmen * Warum komplexe Passworter kontraproduktiv sind * KI-Strategie: Bloss nicht den Anschluss verlieren * Verstoss gegen NIS2: Wer haftet wann und wie? * Grafikkarte fur aktuelle Gaming-Setups * Themenspecial: Digitale Souveranitat Share this article Shortlink: https://heise.de/-11221590 Beliebte Bestenlisten Alle bestenlisten[arrow-righ][arrow-righ] [svg] Top 5: Das beste Headset fur Buro & Homeoffice bestenlisten --------------------------------------------------------------------- [svg] Top 10: Der beste Offroad-E-Scooter mit Federung bestenlisten --------------------------------------------------------------------- [svg] Top 10: Die besten Smart-Home-Systeme im Test bestenlisten Alle bestenlisten[arrow-righ][arrow-righ] Advertisement Advertisement Alle Angebote IT News * Newsticker * Hintergrunde * Ratgeber * Tests * Meinungen Online-Magazine * heise+ * Telepolis * heise autos * bestenlisten * tipps+tricks Services * heise shop * heise jobs * heise academy * heise download * heise preisvergleich * Tarifrechner * heise compaliate * Abo bestellen * Mein Abo * Netzwerktools * iMonitor * Loseblattwerke * Spiele Uber Uns * heise medien * heise regioconcept * heise business services * SponsoringLogo Hannover 96 * Mediadaten * Karriere * Presse Newsletter heise-Bot Push Push-Nachrichten Back to top * Kontakt * Impressum * Barriere melden * Vertrage kundigen * Cookies & Tracking * Datenschutz * Mediadaten * 5050682 * Content Management by InterRed * Hosted by Plus.line * Copyright (c) 2025 heise medien Unser Hauptpartner Hannover 96 kopieren *