PTCCVE-2026-77644

PTC Windchill Risk and: improper access control

Critical9.3CVE-2026-77644 · Published Aug 20, 2026 · updated Sep 9, 2026

A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition.

Affected versions

Package	Affected	Fixed in
Windchill Risk and Reliability Enterprise Edition (Formerly Relex) Product	>= 11.1, <= 13.1	No fix yet

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Red
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-306, CWE-620

Date	Advisory	Severity	Fixed in
Aug 20	PTC Windchill: remote code execution Critical9.2Aug 20 CVE-2026-77645No fix yet	Critical9.2	No fix yet
Aug 20	PTC Windchill PDMLink: server-side request forgery High7.7Aug 20 CVE-2026-77646No fix yet	High7.7	No fix yet