CVE-2026-77645 PUBLISHED

Critical Remote Code Execution (RCE) vulnerability reported in Windchill

Assigner: PTC
Reserved: 20.08.2026 Published: 20.08.2026 Updated: 21.08.2026

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red
CVSS Score: 9.2

Product Status

Vendor PTC
Product Windchill PDMLink
Versions Default: unaffected
  • Version 11.0 M030 is affected
  • Version 11.1 M020 is affected
  • Version 11.2.1.0 is affected
  • Version 12.0.2.0 is affected
  • Version 12.1.2.0 is affected
  • Version 13.0.2.0 is affected
  • Version 13.1.0.0 is affected
  • Version 13.1.1.0 is affected
  • Version 13.1.2.0 is affected
  • Version 13.1.3.0 is affected
Vendor PTC
Product FlexPLM
Versions Default: unaffected
  • Version 11.0 M030 is affected
  • Version 11.1 M020 is affected
  • Version 11.2.1.0 is affected
  • Version 12.0.0.0 is affected
  • Version 12.0.2.0 is affected
  • Version 12.0.3.0 is affected
  • Version 12.1.2.0 is affected
  • Version 12.1.3.0 is affected
  • Version 13.0.2.0 is affected
  • Version 13.0.3.0 is affected

Credits

  • Arthur Aires (https://arthurair.es/) reporter
  • brenocss (LinkedIn: @brenocss) reporter
  • Bruno Milreu (LinkedIn: @bruno-milreu) reporter

References

Problem Types

  • CWE-20 Improper input validation CWE
  • CWE-502 Deserialization of untrusted data CWE

Impacts

  • CAPEC-153 Input Data Manipulation
  • CAPEC-586 Object Injection