by Kastro
Paper/Archive/CVE-2026-126325

CVE-2026-126325

PTC Windchill — Critical Remote Code Execution (RCE) vulnerability reported in Windchill

CVSS 9.2
critical.is priorityof 100
28
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Affected

ProductAffectedFixed inSource
Windchill11.0 M030–CNA
Windchill11.1 M020–CNA
Windchill11.2.1.0–CNA
Windchill12.0.2.0–CNA
Windchill12.1.2.0–CNA
Windchill13.0.2.0–CNA
Windchill13.1.0.0–CNA
Windchill13.1.1.0–CNA
Windchill13.1.2.0–CNA
Windchill13.1.3.0–CNA
Windchill13.1.4.0–CNA
FlexPLM11.0 M030–CNA

Scores by source

PTC (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/RE:M/U:Amber
PTC (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

advisoryptc.com/en/support/article/CS483249