PTC Windchill Pdmlink vulnerabilities

4 CVEs affecting PTC Windchill Pdmlink, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77646, published 2026-08-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-12569: PTC Windchill and FlexPLM Improper Input Validation Vulnerability, published 2026-06-18. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-06-25. EPSS: 46% chance of exploitation in the next 30 days. A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * …
CVE-2026-4681, published 2026-03-23. Critical severity, CVSS 9.3. EPSS: 0.8% chance of exploitation in the next 30 days. A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue…
CVE-2026-77645, published 2026-08-20. Critical severity, CVSS 9.2. EPSS: 0.6% chance of exploitation in the next 30 days. A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
CVE-2026-77646, published 2026-08-20. High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days. A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.