PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution
PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution.
PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution.
The security flaw, tracked as CVE-2026-126325, carries a CVSS v4 score of 9.2 out of a maximum of 10.0.
It has been described as a case of improper input validation and deserialization of untrusted data that could result in remote code execution via crafted requests.
The disclosure comes nearly five months after another critical remote code execution (RCE) issue in Windchill and FlexPLM (CVE-2026-12569, CVSS score: 9.3) came under active exploitation.
Then, in July 2026, it emerged that threat actors linked to the Cl0p ransomware operation were weaponizing the flaw as part of a data extortion campaign designed to drop JSP web shells and exfiltrate sensitive product data from manufacturing companies and industrial enterprises.
No action is required on your part, PTC said in a statement posted on its website.
It allows malicious actors to reach far and wide within victim networks, encrypt and exfiltrate proprietary data, and disrupt industrial processes.
In many cases, the impact across these environments has downstream implications for time-sensitive manufacturing, logistics, and fulfillment processes, resulting in material costs per hour of downtime.
Organizations running PTC Windchill and FlexPLM products are recommended to patch exposed systems as soon as possible and monitor for signs of code execution, backdoor access, or web shells on the host.
If your Windchill or FlexPLM environment is hosted by PTC, the patches have been applied on their behalf, and if patching is not an immediate option, it's essential to apply network restrictions to limit the risk of compromise.
What happened
PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution.
The security flaw, tracked as CVE-2026-126325, carries a CVSS v4 score of 9.2 out of a maximum of 10.0.
It has been described as a case of improper input validation and deserialization of untrusted data that could result in remote code execution via crafted requests.
What changed
The disclosure comes nearly five months after another critical remote code execution (RCE) issue in Windchill and FlexPLM (CVE-2026-12569, CVSS score: 9.3) came under active exploitation.
Then, in July 2026, it emerged that threat actors linked to the Cl0p ransomware operation were weaponizing the flaw as part of a data extortion campaign designed to drop JSP web shells and exfiltrate sensitive product data from manufacturing companies and industrial enterprises.
Who is affected
No action is required on your part, PTC said in a statement posted on its website.
It allows malicious actors to reach far and wide within victim networks, encrypt and exfiltrate proprietary data, and disrupt industrial processes.
Why it matters
In many cases, the impact across these environments has downstream implications for time-sensitive manufacturing, logistics, and fulfillment processes, resulting in material costs per hour of downtime.
Organizations running PTC Windchill and FlexPLM products are recommended to patch exposed systems as soon as possible and monitor for signs of code execution, backdoor access, or web shells on the host.
Response
If your Windchill or FlexPLM environment is hosted by PTC, the patches have been applied on their behalf, and if patching is not an immediate option, it's essential to apply network restrictions to limit the risk of compromise.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.