CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

CVE-2026-126325, PTC Windchill and FlexPLM: deserialization of untrusted data lets an unauthenticated remote attacker run code (CVSS 4.0 9.2

cve · CVE-2026-126325

Coverage
1
first 2026-11-13 → last 2026-11-13
Latest activity
2026-11-13
PTC Windchill and FlexPLM: new unauthenticated deserialization RCE patched 11 Nov; fixed releases behind PTC…
Peak priority
notable
1 notable
Targets
manufacturing
sectors: manufacturing
Sources cited
7
5 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-126325, newest first. Check the date before acting on an older one.

  • Apply the patch PTC announced on 2026-11-11 (article CS483249 in PTC's support portal, login required) to every self-hosted Windchill and FlexPLM, internet-reachable servers first, and keep them off networks that untrusted hosts can reach until it is in, because the flaw needs no authentication and PTC names no workaround.
    2026-11-13CVE-2026-126325

Defender insights

What each entry about CVE-2026-126325 tells a defender to do, newest first.

2026-11-13NOTABLEPTC Windchill and FlexPLM: new unauthenticated deserialization RCE patched 11 Nov; fixed releases behind PTC login

Exposure · detection

Story timeline

  1. 2026-11-13CVE-2026-126325, PTC Windchill and FlexPLM: deserialization of untrusted data lets an unauthenticated remote attacker run code (CVSS 4.0 9.2, high attack complexity); PTC announced a patch on 2026-11-11 and keeps the fixed releases behind its support login, no exploitation is reported, and an earlier Windchill flaw was exploited in June
    trending-vulnerabilitiesPTC Windchill and FlexPLM: new unauthenticated deserialization RCE patched 11 Nov; fixed releases behind PTC login

Hunting pivots

Affected products
PTC FlexPLMPTC Windchill
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-13/ptc-windchill-flexplm-cve-2026-126325-deserialization-rce · ATT&CK page ↗

Entries about CVE-2026-126325, PTC Windchill and FlexPLM: deserialization of untrusted data lets an unauthenticated remote attacker run code (CVSS 4.0 9.2 (1)

2026-11-13 · view entry permalink →

NOTABLECVE-2026-126325NATOA2

CVE-2026-126325, PTC Windchill and FlexPLM: deserialization of untrusted data lets an unauthenticated remote attacker run code (CVSS 4.0 9.2, high attack complexity); PTC announced a patch on 2026-11-11 and keeps the fixed releases behind its support login, no exploitation is reported, and an earlier Windchill flaw was exploited in June

PTC's CNA record, published on 2026-11-11, describes CVE-2026-126325 as a critical remote code execution flaw in PTC Windchill and PTC FlexPLM that may be exploited through the deserialization of untrusted data, scored CVSS 4.0 9.2 with high attack complexity, no privileges and no user interaction (ENISA EUVD, 2026-11-11). NCSC Switzerland says successful exploitation lets remote attackers achieve code execution and potentially full system compromise through crafted network requests carrying malicious serialized data, with network access to the exposed system as the prerequisite (NCSC Switzerland, 2026-11-12); BSI describes a remote, anonymous attacker (translated from German) (BSI CERT-Bund, 2026-11-11). The affected release lines are Windchill 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0 and 13.1.0.0 to 13.1.4.0, with ten FlexPLM releases up to 13.1.3.0 (The Hacker News, 2026-11-12).

PTC's Trust Center says a patch has been available since 2026-11-11, that a Windchill administrator applies it, that PTC-hosted environments were patched on the customer's behalf, and that self-hosted customers are urged to apply it as soon as possible (PTC Trust Center, 2026-11-11). The vendor advisory sits behind a customer login, so no fixed release is public (NCSC Switzerland, 2026-11-12). NCSC Switzerland lists the exploitation status as unknown (NCSC Switzerland, 2026-11-12), and PTC's change log records no attack on this flaw (PTC Trust Center, 2026-11-11). The product has a history: CISA listed the earlier Windchill and FlexPLM flaw CVE-2026-12569 as exploited in June (The Hacker News, 2026-06-26), and Ransom-ISAC, eCrime.ch and DEFUSED reported Cl0p-linked attackers chaining a FlexPLM information disclosure with a Windchill login-servlet flaw to drop JSP web shells (The Hacker News, 2026-07-25).

If your Windchill or FlexPLM environment is hosted by PTC, the patches have been applied on their behalf. No action is required on your part.

PTC Trust Center 2026-11-11

Successful exploitation allows remote attackers to achieve remote code execution and potentially full system compromise via crafted network requests containing malicious serialized data.

NCSC Switzerland (Cyber Security Hub post 13174) 2026-11-12

Builds on: PTC Windchill CVE-2026-12569: unauthenticated Java deserialization to RCE on the PLM management… · The advisory records carry no version data at all; a national CERT's structured copy yields the…

vulnerability13 Nov 04:01Zmulti-sourceOpen finding →
Sources: PTC Trust Center · NCSC Switzerland (Cyber Security Hub post 13174) · BSI CERT-Bund (WID-SEC-2026-4540) · ENISA EUVD (EUVD-2026-123544) · The Hacker News

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • thehackernews.com3 (43%)
  • euvdservices.enisa.europa.eu1 (14%)
  • ptc.com1 (14%)
  • security-hub.ncsc.admin.ch1 (14%)
  • wid.cert-bund.de1 (14%)

External references

NVD · cve.org · CISA KEV

All cited sources (7)