Paper/Archive/CVE-2026-4681

CVE-2026-4681

PTC Windchill PDMLink — Critical Remote Code Execution vulnerability reported in Windchill

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 53.9.539 × 2010.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.

Affected

ProductAffectedFixed inSource

Windchill PDMLink11.0 M030–CNA

Windchill PDMLink11.1 M020–CNA

Windchill PDMLink11.2.1.0–CNA

Windchill PDMLink12.0.2.0–CNA

Windchill PDMLink12.1.2.0–CNA

Windchill PDMLink13.0.2.0–CNA

Windchill PDMLink13.1.0.0–CNA

Windchill PDMLink13.1.1.0–CNA

Windchill PDMLink13.1.2.0–CNA

Windchill PDMLink13.1.3.0–CNA

FlexPLM11.0 M030–CNA

FlexPLM11.1 M020–CNA

Scores by source

PTC (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability?srsltid=AfmBOop3e7Nthx5-BsrjKdpZi50wL6l6Bt21Fz0gUub2cIPgdPGV5bNl