PTC patches critical Windchill and FlexPLM RCE flaw CVE-2026-126325

Summary

PTC released patches for CVE-2026-126325, a critical deserialization flaw with a CVSS v4 score of 9.2 that could allow remote code execution in Windchill and FlexPLM via crafted requests. PTC said it has applied the patches to environments it hosts and urged customers running their own systems to patch as soon as possible; the item does not report exploitation of this flaw.

What to do

• Apply PTC's patch to self-hosted Windchill and FlexPLM systems as soon as possible.

• Restrict network access to Windchill and FlexPLM until the patch is installed.

• Monitor hosts for signs of code execution, backdoors or web shells.

Timeline

1. Nov 11, 2026, 4:02 PM UTCMade public by Mastodon
2. Nov 11, 2026, 4:04 PM UTCFirst seen by cve.now1 day
3. Nov 12, 2026, 12:36 PM UTCRecord last updated
4. Nov 12, 2026, 12:36 PM UTCConfirmed as CVE-2026-126325

Evidence 2

1. Nov 11, 2026Social
   Mastodon

   “A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM.”

   +1 more: Mastodon
2. Nov 12, 2026Press
   The Hacker News

   “PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.