CVE-2026-4681

Critical

Published: 23/03/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

A critical remote code execution (RCE) vulnerability in PTC Windchill and PTC FlexPLM, exploitable through deserialization of untrusted data. Affects the listed versions of Windchill PDMLink and FlexPLM.

Risk Assessment

A remote attacker can execute arbitrary code on the server, potentially leading to full system compromise, data theft, and business disruption.

Recommendation

Immediately update Windchill PDMLink and FlexPLM to patched versions and restrict access to the systems.

Original NVD description (English source)

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.