Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-126325: Windchill and FlexPLM could allow attackers to run code remotely
CVE-2026-126325 · published 1 day ago
Summary
PTC Windchill and FlexPLM can be tricked into running malicious code when they handle specially crafted data from outside sources. This could let an attacker take control of the system and access sensitive information. Install the latest updates from the vendor and limit the handling of untrusted data to protect your environment.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ptc | windchill | 11.0 M030 |
| ptc | flexplm | 11.0 M030 |
Original advisory text
Critical Remote Code Execution (RCE) vulnerability reported in Windchill
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
References
- https://www.ptc.com/en/support/article/CS483249 vendor-advisory mitigation permissions-required
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-20Improper Input Validation
CWE-502Deserialization of Untrusted Data
Timeline
Published11 Nov 2026
Updated11 Nov 2026
First seen11 Nov 2026
Track software like this
Free during beta