CVE-2026-77646 PUBLISHED

Server Side Request Forgery (SSRF) vulnerability reported in Windchill

Assigner: PTC
Reserved: 20.08.2026 Published: 20.08.2026 Updated: 20.08.2026

A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/R:U/V:D/RE:M/U:Red
CVSS Score: 7.7

Product Status

Vendor PTC
Product Windchill PDMLink
Versions Default: unaffected
  • Version 11.0 M030 is affected
  • Version 11.1 M020 is affected
  • Version 11.2.1.0 is affected
  • Version 12.0.2.0 is affected
  • Version 12.1.2.0 is affected
  • Version 13.0.2.0 is affected
  • Version 13.1.0.0 is affected
  • Version 13.1.1.0 is affected
  • Version 13.1.2.0 is affected
  • Version 13.1.3.0 is affected
Vendor PTC
Product FlexPLM
Versions Default: unaffected
  • Version 11.0 M030 is affected
  • Version 11.1 M020 is affected
  • Version 11.2.1.0 is affected
  • Version 12.0.0.0 is affected
  • Version 12.0.2.0 is affected
  • Version 12.0.3.0 is affected
  • Version 12.1.2.0 is affected
  • Version 12.1.3.0 is affected
  • Version 13.0.2.0 is affected
  • Version 13.0.3.0 is affected

Credits

  • Richard Clifford of Rootshell Security (https://www.rootshellsecurity.net/) reporter

References

Problem Types

  • CWE-502 Deserialization of untrusted data CWE
  • CWE-918 Server-Side request forgery (SSRF) CWE

Impacts

  • CAPEC-586 Object Injection
  • CAPEC-664 Server Side Request Forgery