CRITICAL CWE-94
CVE-2026-4681
Critical Remote Code Execution vulnerability reported in Windchill
PTC·Windchill PDMLink
9.3/ 10
CVSS 4.0
Critical severity
0.74%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 55% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Mar 23, 2026
- Updated
- Mar 24, 2026
- First covered
- Jun 28, 2026
- Latest story
- 5 months ago
Summary
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.
CWE-94Improper Control of Generation of Code ('Code Injection')
Attack profile
Attack vectorNetwork
ComplexityLow
RequirementsNone
PrivilegesNone
User interactionNone
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:RedAffected products
- PTC Windchill PDMLink11.0 M03011.1 M02011.2.1.012.0.2.0
- PTC FlexPLM11.0 M03011.1 M02011.2.1.012.0.0.0