CVE-2026-126325: Critical Remote Code Execution (RCE) vulnerability reported in Windchill

Published Nov 11, 2026

Updated

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Event History

Nov 11, 2026

CVE Published

via MITRE·03:02 PM

Data Sourced

via MITRE·03:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require authentication or user interaction?

No. The CVSS vector indicates no privileges are required and no user interaction is needed.

How difficult is exploitation expected to be?

The attack complexity is rated high, indicating exploitation depends on conditions beyond simply reaching a network-accessible target.

What could a successful exploit allow an attacker to do?

The vulnerability is rated high impact for confidentiality, integrity, and availability, with scope changed. A successful exploit could compromise data, alter systems or data, and disrupt service beyond the initially affected component.

CVE-2026-126325: Critical Remote Code Execution (RCE) vulnerability reported in Windchill

Event History

Frequently Asked Questions

Does exploitation require authentication or user interaction?

How difficult is exploitation expected to be?

What could a successful exploit allow an attacker to do?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or user interaction?

How difficult is exploitation expected to be?

What could a successful exploit allow an attacker to do?