A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
Product
PTC FlexPLM vulnerabilities
5 published CVES affecting PTC FlexPLM, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 5
- Critical
- 4
- High
- 1
- Medium
- 0
- Low
- 0
- Unscored
- 0
- CISA KEV
- 1
Latest PTC FlexPLM CVEs
Newest publication first
-
CriticalCVSS 9.2 EPSS 0.51%
-
HighCVSS 7.7 EPSS 0.44%
A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
-
CriticalCVSS 9.2 EPSS 0.56%
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
-
CriticalCVSS 9.3 EPSS 46.0% CISA KEV added 2026-06-25 Ransomware Exploited in the wild
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions The identified vulnerability also im...
-
CriticalCVSS 9.3 EPSS 0.74%
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13....
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.