9.3
Critical
CVE-2026-4681 A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM
Description
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Windchill PDMLink 13.1 | 13.1.0.0 → 13.1.3.0 | No fix stated |
| Windchill PDMLink | 13.0.2.0 | No fix stated |
| Windchill PDMLink | 12.1.2.0 | No fix stated |
| Windchill PDMLink | 12.0.2.0 | No fix stated |
| Windchill PDMLink | 11.2.1.0 | No fix stated |
| FlexPLM 13.0 | 13.0.2.0 → 13.0.3.0 | No fix stated |
| FlexPLM 12.1 | 12.1.2.0 → 12.1.3.0 | No fix stated |
| FlexPLM 12.0 | 12.0.0.0 → 12.0.3.0 | No fix stated |
| FlexPLM | 11.2.1.0 | No fix stated |
Other CVEs of Windchill PDMLink
The 4 CVEs of Windchill PDMLink →
CVE-2026-77646
A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM
7.7
High
CVE-2026-77645
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM
9.2
Critical
CVE-2026-12569
PTC Windchill and FlexPLM Improper Input Validation Vulnerability
9.3
Critical