CVE-2026-126325, PTC Windchill and FlexPLM: deserialization of untrusted data lets an unauthenticated remote attacker run code (CVSS 4.0 9.2, high attack complexity); PTC announced a patch on 2026-11-11 and keeps the fixed releases behind its support login, no exploitation is reported, and an earlier Windchill flaw was exploited in June

PTC's CNA record, published on 2026-11-11, describes CVE-2026-126325 as a critical remote code execution flaw in PTC Windchill and PTC FlexPLM that may be exploited through the deserialization of untrusted data, scored CVSS 4.0 9.2 with high attack complexity, no privileges and no user interaction (ENISA EUVD, 2026-11-11). NCSC Switzerland says successful exploitation lets remote attackers achieve code execution and potentially full system compromise through crafted network requests carrying malicious serialized data, with network access to the exposed system as the prerequisite (NCSC Switzerland, 2026-11-12); BSI describes a remote, anonymous attacker (translated from German) (BSI CERT-Bund, 2026-11-11). The affected release lines are Windchill 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0 and 13.1.0.0 to 13.1.4.0, with ten FlexPLM releases up to 13.1.3.0 (The Hacker News, 2026-11-12).

PTC's Trust Center says a patch has been available since 2026-11-11, that a Windchill administrator applies it, that PTC-hosted environments were patched on the customer's behalf, and that self-hosted customers are urged to apply it as soon as possible (PTC Trust Center, 2026-11-11). The vendor advisory sits behind a customer login, so no fixed release is public (NCSC Switzerland, 2026-11-12). NCSC Switzerland lists the exploitation status as unknown (NCSC Switzerland, 2026-11-12), and PTC's change log records no attack on this flaw (PTC Trust Center, 2026-11-11). The product has a history: CISA listed the earlier Windchill and FlexPLM flaw CVE-2026-12569 as exploited in June (The Hacker News, 2026-06-26), and Ransom-ISAC, eCrime.ch and DEFUSED reported Cl0p-linked attackers chaining a FlexPLM information disclosure with a Windchill login-servlet flaw to drop JSP web shells (The Hacker News, 2026-07-25).