Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126325 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-11 |
| Vendor | PTC |
| Product | Windchill and FlexPLM |
| Vulnerability Type | deserialization of untrusted data, remote code execution (CWE-502) |
| CVSS Score | 9.0 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
According to the CVSS vector, the attack is carried out over the network and requires no authentication, although its complexity is high. Windchill is a PLM system where manufacturers store engineering documentation, CAD models and product data — compromising the server means access to intellectual property.
Required Actions
- Apply the fixes or workarounds from PTC article CS483249 (affected versions and recommended actions).
- Restrict access to Windchill and FlexPLM servers to the internal network or VPN — do not expose them to the internet.
- Review application server logs for unusual requests and child processes spawned by the Windchill service.
Who Is Affected?
The vulnerability affects PTC Windchill and PTC FlexPLM. Windchill is used by manufacturers (automotive, machinery, electronics); FlexPLM by apparel and retail companies.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126325 vulnerability?
CVE-2026-126325 is a deserialization of untrusted data flaw (CWE-502) in PTC Windchill and FlexPLM that enables remote code execution. CVSS score: 9.0.
Does exploiting CVE-2026-126325 require authentication?
According to the CVSS vector the attack requires no authentication, but its complexity is high.
How to protect against CVE-2026-126325?
Apply the fixes or workarounds from PTC article CS483249 and restrict network access to Windchill and FlexPLM servers.
Who is affected by CVE-2026-126325?
Manufacturing and retail companies running PTC Windchill or PTC FlexPLM.
