critical
advisory
PTC Windchill and PTC FlexPLM: Remote code execution (CVE-2026-126325)
A critical remote code execution vulnerability involving insecure deserialization has been reported in PTC Windchill and PTC FlexPLM.
CVE search metadata
CVE search record: CVE-2026-126325. Severity: critical. CVSS: 9.0. KEV: no. Product: Windchill, FlexPLM. Brief: PTC Windchill and PTC FlexPLM: Remote code execution (CVE-2026-126325). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ptc-rce-cve-2026-126325/
Triage facts
Revision 1- Applicability
- Windchill, FlexPLM
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 16:16 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
PTC Windchill and PTC FlexPLM are affected by a critical remote code execution (RCE) vulnerability, identified as CVE-2026-126325. The vulnerability may be exploited through the deserialization of untrusted data.
Impact
The vulnerability has a CVSS v3.1 base score of 9.0.
Recommendation
Monitor official vendor advisories regarding this vulnerability.