---
id: "CVE-2026-126325"
page: "https://infrastack.ai/live/CVE-2026-126325"
kind: "vulnerability"
aliases: ["CVE-2026-126325"]
title: "PTC Windchill and FlexPLM: untrusted data deserialization allows remote code execution"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["ptc-flexplm", "ptc-windchill", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-11-11T15:17:22+00:00"
first_seen_at: "2026-11-11T15:27:49+00:00"
updated_at: "2026-11-11T15:30:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126325", "first_seen_at": "2026-11-11T15:27:49+00:00"}, {"source": "analyst", "url": "https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability", "first_seen_at": "2026-11-11T15:30:57+00:00", "cites": ["https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability"]}]
exploit_sources: []
---

# PTC Windchill and FlexPLM: untrusted data deserialization allows remote code execution

Link for people: https://infrastack.ai/live/CVE-2026-126325 (this .md is for agents)

PTC Windchill and PTC FlexPLM have a critical flaw where untrusted data is deserialized. An attacker who can send crafted data may be able to run code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown for this CVE id. PTC's Windchill/FlexPLM advisory points to eSupport article CS473270 for the affected-version list (login required). If you run self-hosted Windchill or FlexPLM, check that article and the installed patch level, and search logs for POSTs to /Windchill/login/<hex>.jsp, which are IOCs for the related June attack.

## Timeline

- 2026-11-11T15:27:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126325
- 2026-11-11T15:30:57+00:00 analyst https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability — PTC Trust Center page (linked as mentions) does not name CVE-2026-126325. Closest match: its 8/20/2026 entry for CVE-2026-77645, an RCE through deserialization of untrusted data in Windchill and FlexPLM with CVSS v4 9.2, the same score as this record. That CVE is not this id, so I could not confirm the mapping. The 7/14 patches (SUPs 13.1.3 and 13.1.2, CPSXB for older lines) are for the June CVE-2026-12569, which is actively exploited and unauthenticated. Not confirmed for this id: affected versions, fix, auth requirement, exploitation. Nothing marked verified. Settle it with PTC eSupport CS473270 or the CVE.org record. The id may be a typo or a duplicate of CVE-2026-77645 or CVE-2026-12569; code decides merges.

## Documents

- [mentions] PTC Trust Center: Windchill and FlexPLM RCE (CVE-2026-12569 and later updates) https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability

## From the sources

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_