Critical severity · published Aug 20, 2026
CVE-2026-77645
Critical Remote Code Execution (RCE) vulnerability reported in Windchill
9.2
CVSS
0.6%
EPSS
No
On KEV
Description
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
FlexPLM · PTC
11.0 M030; 11.1 M020; 11.2.1.0; 12.0.0.0; 12.0.2.0; 12.0.3.0; +4 more · source: vendor
WP
Windchill PDMLink · PTC
11.0 M030; 11.1 M020; 11.2.1.0; 12.0.2.0; 12.1.2.0; 13.0.2.0; +4 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77645
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77645
www.ptc.com
https://www.ptc.com/en/support/article/CS474826
More from FlexPLM
9.8
CVE-2026-12569
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
9.3
CVE-2026-4681
Critical Remote Code Execution vulnerability reported in Windchill
7.7
CVE-2026-77646
Server Side Request Forgery (SSRF) vulnerability reported in Windchill