# SZB-c5bb586913: PTC patches critical Windchill and FlexPLM RCE flaw CVE-2026-126325

PTC released patches for CVE-2026-126325, a critical deserialization flaw with a CVSS v4 score of 9.2 that could allow remote code execution in Windchill and FlexPLM via crafted requests.

- Type: Early warning
- Kind: Pending CVE
- Vendor: PTC
- Product: Windchill, FlexPLM
- Threat actor: Cl0p
- Status: Confirmed
- Sources: 2 distinct
- First seen: 2026-11-11 16:04 UTC
- Confirmed: 2026-11-12 12:36 UTC

Written by a model from the sources below. Verify against them.

## Summary

PTC released patches for CVE-2026-126325, a critical deserialization flaw with a CVSS v4 score of 9.2 that could allow remote code execution in Windchill and FlexPLM via crafted requests. PTC said it has applied the patches to environments it hosts and urged customers running their own systems to patch as soon as possible; the item does not report exploitation of this flaw.

## What to do

- Apply PTC's patch to self-hosted Windchill and FlexPLM systems as soon as possible.
- Restrict network access to Windchill and FlexPLM until the patch is installed.
- Monitor hosts for signs of code execution, backdoors or web shells.

## Timeline

- 2026-11-11 16:02 UTC: Made public by Mastodon
- 2026-11-11 16:04 UTC: First seen by cve.now
- 2026-11-12 12:36 UTC: Record last updated
- 2026-11-12 12:36 UTC: Confirmed as CVE-2026-126325

## Evidence (2 sources)

- 2026-11-11 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117598645862918694): “A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM.” (+1 more: [Mastodon](https://mastodon.social/@thehackerwire/117598821458585110))
- 2026-11-12 · Press · [The Hacker News](https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html): “PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-c5bb586913&body=https%3A%2F%2Fcve.now%2FSZB-c5bb586913%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-c5bb586913

### Has PTC confirmed it?

Yes. Confirmed as CVE-2026-126325.

Source: https://mastodon.social/@EUVD_Bot/117598645862918694, https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html

### What should PTC and Windchill users do?

Apply PTC's patch to self-hosted Windchill and FlexPLM systems as soon as possible. Restrict network access to Windchill and FlexPLM until the patch is installed. Monitor hosts for signs of code execution, backdoors or web shells.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-126325 and CVE-2026-12569.

Source: https://cve.now/CVE-2026-126325, https://cve.now/CVE-2026-12569

## Tracked as

- [CVE-2026-126325](https://cve.now/CVE-2026-126325.md)
- [CVE-2026-12569](https://cve.now/CVE-2026-12569.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-c5bb586913
Site guide for agents: https://cve.now/llms.txt