CVE-2026-77645 - Vulnerability Details - OpenCVE

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Ptc	Flexplm Windchill Pdmlink

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Ptc	Flexplm Windchill Pdmlink

References

Link	Providers
https://www.ptc.com/en/support/article/CS474826

History

Fri, 21 Aug 2026 01:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ptc Ptc flexplm Ptc windchill Pdmlink
Vendors & Products		Ptc Ptc flexplm Ptc windchill Pdmlink

Thu, 20 Aug 2026 22:15:00 +0000

Type	Values Removed	Values Added
Description		A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
Title		Critical Remote Code Execution (RCE) vulnerability reported in Windchill
Weaknesses		CWE-20 CWE-502
References		https://www.ptc.com/en/support/article/CS474826
Metrics		cvssV4_0 `{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red'}`

MITRE

Status: PUBLISHED

Assigner: PTC

Published: 2026-08-20T22:08:41.642Z

Updated: 2026-08-20T22:08:41.642Z

Reserved: 2026-08-20T22:07:21.684Z

Link: CVE-2026-77645

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-20T22:18:06.510

Modified: 2026-08-20T22:18:06.510

Link: CVE-2026-77645

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-21T01:15:07Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77645", "assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e", "state": "PUBLISHED", "assignerShortName": "PTC", "dateReserved": "2026-08-20T22:07:21.684Z", "datePublished": "2026-08-20T22:08:41.642Z", "dateUpdated": "2026-08-20T22:08:41.642Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e", "shortName": "PTC", "dateUpdated": "2026-08-20T22:08:41.642Z"}, "title": "Critical Remote Code Execution (RCE) vulnerability reported in Windchill", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper input validation", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502 Deserialization of untrusted data", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}, {"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "affected": [{"vendor": "PTC", "product": "Windchill PDMLink", "versions": [{"status": "affected", "version": "11.0 M030"}, {"status": "affected", "version": "11.1 M020"}, {"status": "affected", "version": "11.2.1.0"}, {"status": "affected", "version": "12.0.2.0"}, {"status": "affected", "version": "12.1.2.0"}, {"status": "affected", "version": "13.0.2.0"}, {"status": "affected", "version": "13.1.0.0"}, {"status": "affected", "version": "13.1.1.0"}, {"status": "affected", "version": "13.1.2.0"}, {"status": "affected", "version": "13.1.3.0"}], "defaultStatus": "unaffected"}, {"vendor": "PTC", "product": "FlexPLM", "versions": [{"status": "affected", "version": "11.0 M030"}, {"status": "affected", "version": "11.1 M020"}, {"status": "affected", "version": "11.2.1.0"}, {"status": "affected", "version": "12.0.0.0"}, {"status": "affected", "version": "12.0.2.0"}, {"status": "affected", "version": "12.0.3.0"}, {"status": "affected", "version": "12.1.2.0"}, {"status": "affected", "version": "12.1.3.0"}, {"status": "affected", "version": "13.0.2.0"}, {"status": "affected", "version": "13.0.3.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data."}]}], "references": [{"url": "https://www.ptc.com/en/support/article/CS474826", "tags": ["vendor-advisory", "mitigation", "permissions-required"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "USER", "valueDensity": "CONCENTRATED", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "RED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.2, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red"}}], "credits": [{"lang": "en", "value": "Arthur Aires (https://arthurair.es/)", "type": "reporter"}, {"lang": "en", "value": "brenocss (LinkedIn: @brenocss)", "type": "reporter"}, {"lang": "en", "value": "Bruno Milreu (LinkedIn: @bruno-milreu)", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Windchill PDMLink", "vendor": "PTC", "versions": [{"status": "affected", "version": "11.0 M030"}, {"status": "affected", "version": "11.1 M020"}, {"status": "affected", "version": "11.2.1.0"}, {"status": "affected", "version": "12.0.2.0"}, {"status": "affected", "version": "12.1.2.0"}, {"status": "affected", "version": "13.0.2.0"}, {"status": "affected", "version": "13.1.0.0"}, {"status": "affected", "version": "13.1.1.0"}, {"status": "affected", "version": "13.1.2.0"}, {"status": "affected", "version": "13.1.3.0"}]}, {"defaultStatus": "unaffected", "product": "FlexPLM", "vendor": "PTC", "versions": [{"status": "affected", "version": "11.0 M030"}, {"status": "affected", "version": "11.1 M020"}, {"status": "affected", "version": "11.2.1.0"}, {"status": "affected", "version": "12.0.0.0"}, {"status": "affected", "version": "12.0.2.0"}, {"status": "affected", "version": "12.0.3.0"}, {"status": "affected", "version": "12.1.2.0"}, {"status": "affected", "version": "12.1.3.0"}, {"status": "affected", "version": "13.0.2.0"}, {"status": "affected", "version": "13.0.3.0"}]}], "source": "0b655efc-079c-4cb9-9e8d-164871239f4e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data."}], "id": "CVE-2026-77645", "lastModified": "2026-08-20T22:18:06.510", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "0b655efc-079c-4cb9-9e8d-164871239f4e", "type": "Secondary"}]}, "published": "2026-08-20T22:18:06.510", "references": [{"source": "0b655efc-079c-4cb9-9e8d-164871239f4e", "url": "https://www.ptc.com/en/support/article/CS474826"}], "sourceIdentifier": "0b655efc-079c-4cb9-9e8d-164871239f4e", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-502"}], "source": "0b655efc-079c-4cb9-9e8d-164871239f4e", "type": "Secondary"}]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.0 M030"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.1 M020"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.2.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.0.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.0.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.0.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.1.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.1.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.0.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.0.3.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FlexPLM", "source": "cna", "vendor": "PTC"}, "product": "flexplm", "vendor": "ptc"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.0 M030"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.1 M020"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.2.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.0.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.1.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.0.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.1.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.1.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.1.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.1.3.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Windchill PDMLink", "source": "cna", "vendor": "PTC"}, "product": "windchill_pdmlink", "vendor": "ptc"}], "created": "2026-08-21T01:00:04.329997+00:00", "updated": "2026-08-21T01:15:07.269162+00:00", "vendors": ["ptc", "ptc$PRODUCT$flexplm", "ptc$PRODUCT$windchill_pdmlink"]}