AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

PTCCVE-2026-77646

PTC Windchill PDMLink: server-side request forgery

PTC

CVE-2026-77646 · Published Aug 20, 2026 · updated Sep 9, 2026

High7.7
No fix yet
PTC advisory

A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Affected versions

PackageAffectedFixed in
FlexPLM
Product
<= 11.0 M030No fix yet
<= 11.1 M020No fix yet
<= 11.2.1.0No fix yet
<= 12.0.0.0No fix yet
Windchill PDMLink
Product
<= 11.0 M030No fix yet
<= 11.1 M020No fix yet
<= 11.2.1.0No fix yet
<= 12.0.2.0No fix yet
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-502, CWE-918

More PTC advisories

All PTC
Critical 9.3Aug 20PTC Windchill Risk and: improper access controlCVE-2026-77644no fix yetCritical 9.2Aug 20PTC Windchill: remote code executionCVE-2026-77645no fix yet