by Kastro
Paper/Archive/CVE-2026-77645

CVE-2026-77645

PTC Windchill PDMLink — Critical Remote Code Execution (RCE) vulnerability reported in Windchill

EPSS 0.6%CVSS 9.2
critical.is priorityof 100
37
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 46.6.466 × 209.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Affected

ProductAffectedFixed inSource
Windchill PDMLink11.0 M030–CNA
Windchill PDMLink11.1 M020–CNA
Windchill PDMLink11.2.1.0–CNA
Windchill PDMLink12.0.2.0–CNA
Windchill PDMLink12.1.2.0–CNA
Windchill PDMLink13.0.2.0–CNA
Windchill PDMLink13.1.0.0–CNA
Windchill PDMLink13.1.1.0–CNA
Windchill PDMLink13.1.2.0–CNA
Windchill PDMLink13.1.3.0–CNA
FlexPLM11.0 M030–CNA
FlexPLM11.1 M020–CNA

Scores by source

PTC (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryptc.com/en/support/article/CS474826