PTC Patches Critical Windchill and FlexPLM Flaw Enabling Remote Code Execution
PTC has addressed a critical vulnerability (CVE-2026-126325) in its Windchill and FlexPLM software, rated 9.2/10, which could allow remote code execution.
PTC has released critical security updates to address a vulnerability in its Windchill and FlexPLM software that could allow for remote code execution. The flaw, identified as CVE-2026-126325, carries a high CVSS v4 score of 9.2 out of a possible 10.0, underscoring its severity.
The vulnerability stems from improper input validation and the deserialization of untrusted data. Attackers can exploit this by sending specially crafted requests to the affected systems, leading to the execution of arbitrary code on the target server. This type of vulnerability is particularly dangerous as it can provide attackers with a direct pathway into an organization's critical systems.
Several versions of PTC Windchill and FlexPLM are affected by this vulnerability. These include Windchill versions 11.0 M030 through 13.1.4.0, and FlexPLM versions 11.0 M030 through 13.1.3.0. Organizations running any of these versions are strongly advised to apply the provided patches.
PTC has stated that customers whose environments are hosted by PTC have already had the patches applied automatically, requiring no further action from their side. However, for customers hosting their own Windchill or FlexPLM environments, PTC urges them to apply the patches as soon as possible to mitigate the risk of compromise.
This disclosure follows a similar critical remote code execution vulnerability (CVE-2026-12569) that affected the same products approximately five months prior. That earlier flaw was actively exploited by threat actors, including those linked to the Cl0p ransomware operation, who used it to deploy web shells and exfiltrate sensitive data from manufacturing and industrial companies.
The potential impact of such vulnerabilities on industrial environments is significant. As noted by Yordan Ganchev, principal threat intelligence specialist at watchTowr, PTC software is a prime target for initial access brokers and ransomware operators. Exploitation can lead to widespread network compromise, data encryption and exfiltration, and disruption of critical industrial processes, with downstream effects on manufacturing, logistics, and fulfillment.
To protect against this threat, organizations are recommended to promptly patch their exposed PTC Windchill and FlexPLM systems. Continuous monitoring for signs of unauthorized code execution, backdoor access, or web shells is also crucial. If immediate patching is not feasible, implementing network restrictions to limit exposure is a vital interim mitigation step.