Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
PTC Windchill and FlexPLM can run attacker code
published recently · actively exploited
Summary
The Windchill and FlexPLM product suite does not properly check data it receives over the network. This lets anyone on the internet send a specially crafted request that can cause the system to execute their own programs. Apply the latest security patch from the vendor as soon as possible and restrict network access to these applications.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ptc | windchill and flexplm | All versions |
Original advisory text
PTC Windchill and FlexPLM Improper Input Validation Vulnerability
PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.
Exploitation
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
Timeline
Updated29 Aug 2026
First seen29 Aug 2026
Track software like this
Free during beta