CVE-2026-126325
9.0CVSS base score · critical (NVD)
Not in KEVNo confirmed exploitation in CISA's catalog yet
What is it?
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
Official description from NVD.
What happened
PTC released patches for CVE-2026-126325, a critical vulnerability in Windchill and FlexPLM caused by improper input validation and untrusted data deserialization. The flaw has a CVSS score of 9.2 and enables remote code execution. Administrators should apply patches immediately to prevent exploitation of these widely deployed product lifecycle management tools.
From the Intel60 brief of Nov 12, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalPTC patches critical Windchill and FlexPLM RCE flawNov 12, 2026