CVE-2026-126325 Critical Remote Code Execution (RCE) vulnerability reported in Windchill
CriticalCVSS 9.2
- Published
- Updated
- Exploit status
- No public exploit known
Description
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PTC Windchill | = 11.0 M030 | No fix listed |
| PTC Windchill | = 11.1 M020 | No fix listed |
| PTC Windchill | = 11.2.1.0 | No fix listed |
| PTC Windchill | = 12.0.2.0 | No fix listed |
| PTC Windchill | = 12.1.2.0 | No fix listed |
| PTC Windchill | = 13.0.2.0 | No fix listed |
| PTC Windchill | = 13.1.0.0 | No fix listed |
| PTC Windchill | = 13.1.1.0 | No fix listed |
| PTC Windchill | = 13.1.2.0 | No fix listed |
| PTC Windchill | = 13.1.3.0 | No fix listed |
| PTC Windchill | = 13.1.4.0 | No fix listed |
| PTC FlexPLM | = 11.0 M030 | No fix listed |
| PTC FlexPLM | = 11.1 M020 | No fix listed |
| PTC FlexPLM | = 11.2.1.0 | No fix listed |
| PTC FlexPLM | = 12.0.2.0 | No fix listed |
| PTC FlexPLM | = 12.1.2.0 | No fix listed |
| PTC FlexPLM | = 13.0.2.0 | No fix listed |
| PTC FlexPLM | = 13.1.0.0 | No fix listed |
| PTC FlexPLM | = 13.1.1.0 | No fix listed |
| PTC FlexPLM | = 13.1.2.0 | No fix listed |
| PTC FlexPLM | = 13.1.3.0 | No fix listed |
References
- Remote Code Execution (RCE) vulnerability (CVE-2026-126325) reported in Windchill PDMLink and FlexPLM mitigation permissions-required vendor-advisory