{"id":"CVE-2026-126325","kind":"vulnerability","aliases":["CVE-2026-126325"],"related":[],"title":"PTC Windchill and FlexPLM: untrusted data deserialization allows remote code execution","description":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.","summary":"PTC Windchill and PTC FlexPLM have a critical flaw where untrusted data is deserialized. An attacker who can send crafted data may be able to run code on the server.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ptc-flexplm","ptc-windchill","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"Unknown for this CVE id. PTC's Windchill/FlexPLM advisory points to eSupport article CS473270 for the affected-version list (login required). If you run self-hosted Windchill or FlexPLM, check that article and the installed patch level, and search logs for POSTs to /Windchill/login/<hex>.jsp, which are IOCs for the related June attack.","fix":null,"status":"open","published_at":"2026-11-11T15:17:22+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","triaged_at":"2026-11-11T15:29:40+00:00","updated_at":"2026-11-11T15:30:57+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-11-11T15:29:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"PTC Windchill and FlexPLM: untrusted data deserialization allows remote code execution","impact":"high","summary":"PTC Windchill and PTC FlexPLM have a critical flaw where untrusted data is deserialized. An attacker who can send crafted data may be able to run code on the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ptc-windchill","ptc-flexplm","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the Windchill or FlexPLM server","analyst_note":"Find the PTC security advisory for CVE-2026-126325 to confirm affected versions, fixed releases and whether the attack is unauthenticated.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations that run PTC Windchill or PTC FlexPLM for product lifecycle management. The sources do not name affected versions or the exact entry point, so the unknown details should be confirmed with the vendor advisory.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000678,"input_tokens":4521,"output_tokens":451,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the PTC security advisory for CVE-2026-126325 to confirm affected versions, fixed releases and whether the attack is unauthenticated.","search":"'-126325':14A,17A '-2026':13A,16A 'abl':51B 'allow':8A 'attack':43B 'code':10A,54B,61C 'craft':47B 'critic':35B,59C 'cve':12A,15A 'data':6A,39B,48B,84C 'deseri':7A,41B,81C 'execut':11A,62C 'exploit':78C 'flaw':36B 'flexplm':4A,20B,32B,73C 'host':26B 'may':49B,76C 'ptc':1A,19B,22B,28B,31B,69C,72C 'ptc-flexplm':18B 'ptc-windchil':21B 'rce':63C 'remot':9A,60C 'report':67C 'run':53B 'self':25B 'self-host':24B 'send':46B 'server':57B 'untrust':5A,38B,83C 'vendor':27B 'vulner':64C,75C 'windchil':2A,23B,29B,70C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host PTC Windchill PDMLink or FlexPLM. The advisory text for this exact CVE id was not found, so versions and whether the flaw is reachable without login are unconfirmed. PTC-hosted instances are being remediated by PTC for the related June CVE-2026-12569.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","ptcflexplm","ptcwindchill","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126325':14A,17A '-2026':13A,16A 'allow':8A 'code':10A 'cve':12A,15A 'data':6A 'deseri':7A 'execut':11A 'flexplm':4A 'ptc':1A 'remot':9A 'untrust':5A 'windchil':2A","search_b":"'abl':51B 'attack':43B 'code':54B 'craft':47B 'critic':35B 'data':39B,48B 'deseri':41B 'flaw':36B 'flexplm':20B,32B 'host':26B 'may':49B 'ptc':19B,22B,28B,31B 'ptc-flexplm':18B 'ptc-windchil':21B 'run':53B 'self':25B 'self-host':24B 'send':46B 'server':57B 'untrust':38B 'vendor':27B 'windchil':23B,29B","search_c":"'code':61C 'critic':59C 'data':84C 'deseri':81C 'execut':62C 'exploit':78C 'flexplm':73C 'may':76C 'ptc':69C,72C 'rce':63C 'remot':60C 'report':67C 'untrust':83C 'vulner':64C,75C 'windchil':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber","cvss_by":"0b655efc-079c-4cb9-9e8d-164871239f4e","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126325","severity":null,"published_at":"2026-11-11T15:17:22+00:00","modified_at":"2026-11-11T15:17:22+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","fetched_at":"2026-11-11T15:27:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126325:3561","url":"https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability","severity":null,"published_at":"2026-11-11T15:30:57+00:00","modified_at":"2026-11-11T15:30:57+00:00","first_seen_at":"2026-11-11T15:30:57+00:00","fetched_at":"2026-11-11T15:30:57+00:00","note":"PTC Trust Center page (linked as mentions) does not name CVE-2026-126325. Closest match: its 8/20/2026 entry for CVE-2026-77645, an RCE through deserialization of untrusted data in Windchill and FlexPLM with CVSS v4 9.2, the same score as this record. That CVE is not this id, so I could not confirm the mapping. The 7/14 patches (SUPs 13.1.3 and 13.1.2, CPSXB for older lines) are for the June CVE-2026-12569, which is actively exploited and unauthenticated. Not confirmed for this id: affected versions, fix, auth requirement, exploitation. Nothing marked verified. Settle it with PTC eSupport CS473270 or the CVE.org record. The id may be a typo or a duplicate of CVE-2026-77645 or CVE-2026-12569; code decides merges.","cites":["https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability"]}],"documents":[{"id":126640,"url":"https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability","title":"PTC Trust Center: Windchill and FlexPLM RCE (CVE-2026-12569 and later updates)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}