CVE-2026-4681

criticalpriority · track · 0EPSS 0.007 · 54 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.72% (54th) EPSS

CVSS 10 · critical

Is it mine?

62 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · cisa_csaf_ot

EPSS · scored 2026-10-26

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedFlexPLMcisa_csaf_ot
Apply the same precautions to FlexPLM deployments
MitigationFlexPLMcisa_csaf_ot
Customers using Microsoft IIS should only follow "IIS Configuration - Workaround Steps" section steps
MitigationWindchill PDMLinkcisa_csaf_ot
Customers using Microsoft IIS should only follow "IIS Configuration - Workaround Steps" section steps

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.1–10

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · CISA US

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Redsecondary · ENISA EU

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Redsecondary

v4.08.1highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Redsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-94USCWE-94US

affected products (62)

Products and version ranges known to be affected.

PTC FlexPLM 11.0 M030all versionscert_bundDEcpe:/a:ptc:flexplm:11.0_m030
PTC FlexPLM 11.1 M020all versionscert_bundDEcpe:/a:ptc:flexplm:11.1_m020
PTC FlexPLM 11.2.1.0all versionscert_bundDEcpe:/a:ptc:flexplm:11.2.1.0
PTC FlexPLM 12.0.0.0all versionscert_bundDEcpe:/a:ptc:flexplm:12.0.0.0
PTC FlexPLM 12.0.2.0all versionscert_bundDEcpe:/a:ptc:flexplm:12.0.2.0
PTC FlexPLM 12.0.3.0all versionscert_bundDEcpe:/a:ptc:flexplm:12.0.3.0
PTC FlexPLM 12.1.2.0all versionscert_bundDEcpe:/a:ptc:flexplm:12.1.2.0
PTC FlexPLM 12.1.3.0all versionscert_bundDEcpe:/a:ptc:flexplm:12.1.3.0
PTC FlexPLM 13.0.2.0all versionscert_bundDEcpe:/a:ptc:flexplm:13.0.2.0
PTC FlexPLM 13.0.3.0all versionscert_bundDEcpe:/a:ptc:flexplm:13.0.3.0
PTC Windchill 11.0 M030all versionscert_bundDEcpe:/a:ptc:windchill:11.0_m030
PTC Windchill 11.1 M020all versionscert_bundDEcpe:/a:ptc:windchill:11.1_m020
PTC Windchill 11.2.1.0all versionscert_bundDEcpe:/a:ptc:windchill:11.2.1.0
PTC Windchill 12.0.2.0all versionscert_bundDEcpe:/a:ptc:windchill:12.0.2.0
PTC Windchill 12.1.2.0all versionscert_bundDEcpe:/a:ptc:windchill:12.1.2.0
PTC Windchill 13.0.2.0all versionscert_bundDEcpe:/a:ptc:windchill:13.0.2.0
PTC Windchill 13.1.0.0all versionscert_bundDEcpe:/a:ptc:windchill:13.1.0.0
PTC Windchill 13.1.1.0all versionscert_bundDEcpe:/a:ptc:windchill:13.1.1.0
PTC Windchill 13.1.2.0all versionscert_bundDEcpe:/a:ptc:windchill:13.1.2.0
PTC Windchill 13.1.3.0all versionscert_bundDEcpe:/a:ptc:windchill:13.1.3.0

showing 20 of 62

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-0822PTC FlexPLM und Windchill: Schwachstelle ermöglicht CodeausführungDeutsch2026-03-22csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in PTC FlexPLM und PTC Windchill ausnutzen, um beliebigen Programmcode auszuführen.
ICSA-26-085-03PTC Windchill Product Lifecycle Management2026-03-26icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund cisa_csaf_ot NVD CVE.org MITRE

published 2026-03-23modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan