--- schema: 1 kind: vulnerability title: 'CVE-2026-126325, PTC Windchill and FlexPLM: deserialization of untrusted data lets an unauthenticated remote attacker run code (CVSS 4.0 9.2, high attack complexity); PTC announced a patch on 2026-11-11 and keeps the fixed releases behind its support login, no exploitation is reported, and an earlier Windchill flaw was exploited in June' headline: 'PTC Windchill and FlexPLM: new unauthenticated deserialization RCE patched 11 Nov; fixed releases behind PTC login' summary: PTC's CNA record, restated by NCSC Switzerland and BSI, says CVE-2026-126325 lets a remote, unauthenticated attacker run code on PTC Windchill and FlexPLM through deserialization of untrusted data (CVSS 4.0 9.2, high attack complexity), in eleven Windchill and ten FlexPLM release lines. PTC announced a patch on 2026-11-11 (its advisory sits behind a customer login, so no fixed release is public) and has already patched PTC-hosted environments; no source reports exploitation of this flaw, although CISA listed an earlier Windchill and FlexPLM RCE as exploited in June. discovered_at: '2026-11-13T04:01:00Z' updated_at: null event_date: '2026-11-11' run_id: 2026-11-13T0256Z-intel priority: notable immediate_action: null tags: - vulnerabilities - rce - pre-auth - patch-available regions: - global sectors: - manufacturing entities: - product:ptc-windchill - product:ptc-flexplm techniques: - T1190 affected_products: - PTC Windchill - PTC FlexPLM cves: - id: CVE-2026-126325 cvss: 9.2 (CVSS 4.0, PTC; CVSS 3.1 9.0) epss: null type: deserialization vector: zero-click auth: pre-auth status: - patch-available affected: PTC Windchill 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0 and 13.1.0.0 to 13.1.4.0; PTC FlexPLM 11.0 M030 to 13.1.3.0 (release lines as listed in the CVE record) fixed: patch announced by PTC on 2026-11-11 (article CS483249, behind a customer login); no fixed release named in a public source sources: - url: https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability publisher: PTC Trust Center date: '2026-11-11' role: primary - url: https://security-hub.ncsc.admin.ch/#/posts/13174 publisher: NCSC Switzerland (Cyber Security Hub post 13174) date: '2026-11-12' role: corroborating - url: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4540 publisher: BSI CERT-Bund (WID-SEC-2026-4540) date: '2026-11-11' role: corroborating - url: https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-123544 publisher: ENISA EUVD (EUVD-2026-123544) date: '2026-11-11' role: corroborating - url: https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html publisher: The Hacker News date: '2026-11-12' role: corroborating - url: https://thehackernews.com/2026/06/cisa-adds-exploited-ptc-windchill-rce.html publisher: The Hacker News date: '2026-06-26' role: corroborating - url: https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html publisher: The Hacker News date: '2026-07-25' role: corroborating closed_sources: [] evidence: - quote: If your Windchill or FlexPLM environment is hosted by PTC, the patches have been applied on their behalf. No action is required on your part. publisher: PTC Trust Center source_url: https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability - quote: Successful exploitation allows remote attackers to achieve remote code execution and potentially full system compromise via crafted network requests containing malicious serialized data. publisher: NCSC Switzerland (Cyber Security Hub post 13174) source_url: https://security-hub.ncsc.admin.ch/#/posts/13174 verification: multi-source sourcing_note: PTC is the disclosing party and its CNA record and Trust Center are the primary sources; NCSC Switzerland, BSI, ENISA and The Hacker News restate them. PTC's advisory CS483249 is behind a customer login, so the fixed releases per branch are not public; BSI's feed tags the item as unpatched while PTC announced a patch on 2026-11-11 and BSI's record carries no fixed version. confidence: medium references: - 2026-06-20/ptc-windchill-cve-2026-12569-unauthenticated-java-deserializ - 2026-08-22/ptc-windchill-three-new-cves-unauth-rce-no-fixed-version deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - Apply the patch PTC announced on 2026-11-11 (article CS483249 in PTC's support portal, login required) to every self-hosted Windchill and FlexPLM, internet-reachable servers first, and keep them off networks that untrusted hosts can reach until it is in, because the flaw needs no authentication and PTC names no workaround. updates: [] migrated_from: null --- PTC's CNA record, published on 2026-11-11, describes CVE-2026-126325 as a critical remote code execution flaw in PTC Windchill and PTC FlexPLM that may be exploited through the deserialization of untrusted data, scored CVSS 4.0 9.2 with high attack complexity, no privileges and no user interaction ([ENISA EUVD, 2026-11-11](https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-123544)). NCSC Switzerland says successful exploitation lets remote attackers achieve code execution and potentially full system compromise through crafted network requests carrying malicious serialized data, with network access to the exposed system as the prerequisite ([NCSC Switzerland, 2026-11-12](https://security-hub.ncsc.admin.ch/#/posts/13174)); BSI describes a remote, anonymous attacker (translated from German) ([BSI CERT-Bund, 2026-11-11](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4540)). The affected release lines are Windchill 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0 and 13.1.0.0 to 13.1.4.0, with ten FlexPLM releases up to 13.1.3.0 ([The Hacker News, 2026-11-12](https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html)). PTC's Trust Center says a patch has been available since 2026-11-11, that a Windchill administrator applies it, that PTC-hosted environments were patched on the customer's behalf, and that self-hosted customers are urged to apply it as soon as possible ([PTC Trust Center, 2026-11-11](https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability)). The vendor advisory sits behind a customer login, so no fixed release is public ([NCSC Switzerland, 2026-11-12](https://security-hub.ncsc.admin.ch/#/posts/13174)). NCSC Switzerland lists the exploitation status as unknown ([NCSC Switzerland, 2026-11-12](https://security-hub.ncsc.admin.ch/#/posts/13174)), and PTC's change log records no attack on this flaw ([PTC Trust Center, 2026-11-11](https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability)). The product has a history: CISA listed the earlier Windchill and FlexPLM flaw CVE-2026-12569 as exploited in June ([The Hacker News, 2026-06-26](https://thehackernews.com/2026/06/cisa-adds-exploited-ptc-windchill-rce.html)), and Ransom-ISAC, eCrime.ch and DEFUSED reported Cl0p-linked attackers chaining a FlexPLM information disclosure with a Windchill login-servlet flaw to drop JSP web shells ([The Hacker News, 2026-07-25](https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html)). **Exposure:** a self-hosted Windchill or FlexPLM server on one of the listed release lines that a hostile network can reach; PTC-hosted environments need no action ([PTC Trust Center, 2026-11-11](https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability)). **Detection:** no source gives a detection for this flaw. For the June intrusions PTC told readers to search access logs for POST requests to /Windchill/login/ JSP files, which legitimate traffic does not make, and to look for persistent JSP web shells in the Windchill login directory ([PTC Trust Center, 2026-11-11](https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability)); whether the same pattern applies to CVE-2026-126325 is not stated. **Defender takeaway:** patch self-hosted Windchill and FlexPLM now, internet-reachable servers first, and ask PTC for the fixed release of your line through the support portal, because no fixed version is public ([NCSC Switzerland, 2026-11-12](https://security-hub.ncsc.admin.ch/#/posts/13174)).