CVE-2026-4681 — Critical Remote Code Execution vulnerability reported in Windchill

Description (CNA)

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.

Affected (CNA)

Vendor / product	Versions
PTC / Windchill PDMLink	affected 11.0 M030; affected 11.1 M020; affected 11.2.1.0; affected 12.0.2.0; affected 12.1.2.0; affected 13.0.2.0; affected 13.1.0.0; affected 13.1.1.0; affected 13.1.2.0; affected 13.1.3.0
PTC / FlexPLM	affected 11.0 M030; affected 11.1 M020; affected 11.2.1.0; affected 12.0.0.0; affected 12.0.2.0; affected 12.0.3.0; affected 12.1.2.0; affected 12.1.3.0; affected 13.0.2.0; affected 13.0.3.0

CWE

CWE-94

References

https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability?srsltid=AfmBOop3e7Nthx5-BsrjKdpZi50wL6l6Bt21Fz0gUub2cIPgdPGV5bNl

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.