Remote Code Execution Vulnerability in PTC Windchill and FlexPLM
CVE-2026-126325

9.2CRITICAL

Key Information:

Vendor

Ptc

Status
Windchill
Flexplm
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126325?

A remote code execution vulnerability has been identified in PTC Windchill and PTC FlexPLM that can be exploited via the deserialization of untrusted data. This flaw may allow an attacker to execute arbitrary code within the context of the affected application, potentially leading to unauthorized access and significant risks to system integrity. It is essential for users of these products to apply recommended mitigations to protect against potential exploitation.

Affected Version(s)

FlexPLM 11.0 M030

FlexPLM 11.1 M020

FlexPLM 11.2.1.0

References

https://www.ptc.com/en/support/article/CS483249
vendor-advisorymitigationpermissions-required

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.