CVE-2026-77645CWE-20CWE-502insecure-deserialization

CVE-2026-77645

published August 21, 2026

CVSS
9.2
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

The record
Technical detail
CVSS
9.2 · NONE
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red
EPSS
0.00559 · 45.8th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2026-08-21T02:18Z
References (1)
https://www.ptc.com/en/support/article/CS474826 · 0b655efc-079c-4cb9-9e8d-164871239f4e
EPSS history
Timeline
  • 20 AUG 22:08Z
    Critical Remote Code Execution (RCE) vulnerability reported in Windchill
    cvelistv5