PTCCVE-2026-77646

PTC Windchill PDMLink: server-side request forgery

High7.7CVE-2026-77646 · Published Aug 20, 2026 · updated Sep 9, 2026

A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

PTC advisory

Affected versions

Package	Affected	Fixed in
FlexPLM Product	<= 11.0 M030	No fix yet
	<= 11.1 M020	No fix yet
	<= 11.2.1.0	No fix yet
	<= 12.0.0.0	No fix yet
Windchill PDMLink Product	<= 11.0 M030	No fix yet
	<= 11.1 M020	No fix yet
	<= 11.2.1.0	No fix yet
	<= 12.0.2.0	No fix yet

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-502, CWE-918

More PTC advisories

All PTC

Date	Advisory	Severity	Fixed in
Aug 20	PTC Windchill Risk and: improper access control Critical9.3Aug 20 CVE-2026-77644No fix yet	Critical9.3	No fix yet
Aug 20	PTC Windchill: remote code execution Critical9.2Aug 20 CVE-2026-77645No fix yet	Critical9.2	No fix yet

Affected versions

More PTC advisories

Critical advisories by email