PTCCVE-2026-77645

PTC Windchill: remote code execution

Critical9.2CVE-2026-77645 · Published Aug 20, 2026 · updated Sep 9, 2026

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

PTC advisory

Affected versions

Package	Affected	Fixed in
FlexPLM Product	<= 11.0 M030	No fix yet
	<= 11.1 M020	No fix yet
	<= 11.2.1.0	No fix yet
	<= 12.0.0.0	No fix yet
Windchill PDMLink Product	<= 11.0 M030	No fix yet
	<= 11.1 M020	No fix yet
	<= 11.2.1.0	No fix yet
	<= 12.0.2.0	No fix yet

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-20, CWE-502

More PTC advisories

All PTC

Date	Advisory	Severity	Fixed in
Aug 20	PTC Windchill Risk and: improper access control Critical9.3Aug 20 CVE-2026-77644No fix yet	Critical9.3	No fix yet
Aug 20	PTC Windchill PDMLink: server-side request forgery High7.7Aug 20 CVE-2026-77646No fix yet	High7.7	No fix yet

Affected versions

More PTC advisories

Critical advisories by email