Description
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.
Published: 2026-03-23
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A remote code execution vulnerability arises from the deserialization of untrusted data in PTC Windchill and FlexPLM. The flaw is classified as CWE‑94 and can enable an attacker to run arbitrary code with the privileges of the application, leading to a full compromise of confidentiality, integrity, and availability of the affected systems. The high CVSS score of 9.3 reflects the severity of this issue.

Affected Systems

The vulnerability affects PTC Windchill PDMLink versions 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, and 13.1.3.0, as well as PTC FlexPLM versions 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, and 13.0.3.0.

Risk and Exploitability

The CVSS base score of 9.3 indicates a critical risk level. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog, but the nature of the flaw—remote deserialization—suggests that an attacker who can send crafted data to the affected applications may trigger arbitrary code execution. Exploitation requires remote access but does not rely on local privileges, making it potentially reachable from external network traffic.

Generated by OpenCVE AI on March 24, 2026 at 03:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑released patch or upgrade PTC Windchill and FlexPLM to a fixed version that resolves the unsafe deserialization flaw.
  • If a formal patch is not yet available, isolate the affected systems from external network access and monitor for anomalous traffic or attempts to exploit deserialization.
  • Verify that the application does not accept serialized objects from unauthenticated sources and enforce strict validation of deserialized data.

Generated by OpenCVE AI on March 24, 2026 at 03:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 24 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 24 Mar 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Ptc
Ptc flexplm
Ptc windchill Pdmlink
Vendors & Products Ptc
Ptc flexplm
Ptc windchill Pdmlink

Tue, 24 Mar 2026 02:30:00 +0000

Type Values Removed Values Added
Description A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.
Title Critical Remote Code Execution vulnerability reported in Windchill
Weaknesses CWE-94
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red'}

Subscriptions

Ptc Flexplm Windchill Pdmlink
cve-icon MITRE

Status: PUBLISHED

Assigner: PTC

Published:

Updated: 2026-03-24T14:49:43.425Z

Reserved: 2026-03-23T21:42:24.158Z

Link: CVE-2026-4681

cve-icon Vulnrichment

Updated: 2026-03-24T14:49:30.805Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-23T22:16:31.890

Modified: 2026-03-24T15:53:48.067

Link: CVE-2026-4681

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-25T20:36:17Z

Weaknesses