CVE-2026-77646: PTC FlexPLM

High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days.

A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Affected products

• PTC FlexPLM: version 11.0 M030 only; version 11.1 M020 only; version 11.2.1.0 only; version 12.0.0.0 only; version 12.0.2.0 only; version 12.0.3.0 only; …
• PTC Windchill Pdmlink: version 11.0 M030 only; version 11.1 M020 only; version 11.2.1.0 only; version 12.0.2.0 only; version 12.1.2.0 only; version 13.0.2.0 only; …

Published 2026-08-20. Last modified 2026-09-09.