PTC Windchill and FlexPLM: Remote code execution via deserialization
Summary
PTC Windchill and PTC FlexPLM, product lifecycle management systems that store engineering and product data, contain a critical vulnerability caused by deserialization of untrusted data (CWE-20, CWE-502). According to the CVE record, a remote attacker without credentials can execute code on the server, with high impact on confidentiality, integrity and availability. The CVSS v4.0 base score is 9.2. The CVE ID and its details could not be confirmed in public sources, so the record must be verified before acting on it.
Affected
- PTC Windchill: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0, 13.1.4.0
- PTC FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0
Source: CVE record as provided. Not yet verified against PTC article CS483249.
Fixed in
Unknown. Check PTC article CS483249 and the PTC advisory for patched versions.
Workaround
- Restrict internet exposure of the Windchill login endpoint where operationally possible.
- Add WAF or IDS rules and review logs.
- Apply the mitigations to all deployments, including file and replica servers, not only internet-facing systems.
Exploitation
- No confirmed in-the-wild exploitation found for this CVE ID.
- No public proof-of-concept found.
- A related PTC Windchill RCE, CVE-2026-12569, is reported as exploited by the Cl0p ransomware group and is listed in CISA KEV. This is a different CVE.
Status for this CVE ID: Unknown.
Our recommendation
- Verify the CVE ID and PTC article CS483249 before acting on version information.
- Inventory all Windchill and FlexPLM instances, including versions and internet exposure.
- Patch as soon as a fixed version for your release is confirmed; apply the workarounds until then.
- Monitor logs for unusual requests to the login endpoint and for deserialization errors.
- Contact PTC support if you cannot identify the correct patch for your release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- PTC support article CS483249 www.ptc.com
- PTC Trust Center: Windchill and FlexPLM RCE advisory www.ptc.com
- NVD: CVE-2026-4681 (related record, unverified for this ID) nvd.nist.gov
- Security Affairs: CISA and BSI warn of critical PTC Windchill and FlexPLM flaw securityaffairs.com
- Heise: BSI warns admins about critical Windchill vulnerability www.heise.de
- SecurityWeek: PTC Windchill vulnerability exploited in ransomware campaign www.securityweek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:21.
Original description (NVD)
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.