CVE-2026-77645: PTC FlexPLM

Critical severity, CVSS 9.2. EPSS: 0.6% chance of exploitation in the next 30 days.

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Affected products

• PTC FlexPLM: version 11.0 M030 only; version 11.1 M020 only; version 11.2.1.0 only; version 12.0.0.0 only; version 12.0.2.0 only; version 12.0.3.0 only; …
• PTC Windchill Pdmlink: version 11.0 M030 only; version 11.1 M020 only; version 11.2.1.0 only; version 12.0.2.0 only; version 12.1.2.0 only; version 13.0.2.0 only; …

Published 2026-08-20. Last modified 2026-09-09.