Server-Side Request Forgery in PTC Windchill PDMLink and PTC FlexPLM
CVE-2026-77646

7.7HIGH

Key Information:

Vendor

Ptc

Status
Windchill Pdmlink
Flexplm
Vendor
CVE Published:
20 August 2026

What is CVE-2026-77646?

A Server-Side Request Forgery (SSRF) vulnerability has been identified in PTC's Windchill PDMLink and FlexPLM products. This issue allows an attacker to send crafted requests through the server, exploiting improper handling of untrusted data during the deserialization process. This could enable unauthorized access to internal resources and sensitive data, highlighting the need for robust security practices and timely mitigation.

Affected Version(s)

FlexPLM 11.0 M030

FlexPLM 11.1 M020

FlexPLM 11.2.1.0

References

https://www.ptc.com/en/support/article/CS474826
vendor-advisorymitigationpermissions-required

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Richard Clifford of Rootshell Security (https://www.rootshellsecurity.net/)
.