CVE-2026-77645

criticalpriority · track · 0EPSS 0.006 · 46 %ile

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.56% (46th) EPSS

CVSS 9.2 · critical

Is it mine?

0 products

Check your exposure

Who says so?

— sources

EPSS · scored 2026-10-27

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

cvss

Technical severity, 0–10. One row per scoring source.

9.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.2–9.2

v4.09.2criticalCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Redsecondary

v4.07.2highCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Redsecondary · CVSS-BT (t0sche)