CVE-2026-4681CWE-94

Critical Remote Code Execution vulnerability reported in Windchill

Critical · published March 23, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
55.9
In the wild
Unconfirmed
What it is

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red
EPSS
0.00793 · 55.9th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-03-23T21:48Z
EPSS history
Timeline
  • 23 MAR 21:48Z
    Critical Remote Code Execution vulnerability reported in Windchill
    cvelistv5