CVE-2026-77646CWE-502CWE-918insecure-deserializationssrf

CVE-2026-77646

published August 21, 2026

CVSS

7.7

EPSS

Percentile

37.0

In the wild

Unconfirmed

What it is

A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

The record

Technical detail

CVSS: 7.7 · NONE
CVSS v4.0: 7.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/R:U/V:D/RE:M/U:Red
EPSS: 0.00438 · 37.0th percentile
Weaknesses: CWE-502 · Deserialization of Untrusted Data; CWE-918 · Server-Side Request Forgery (SSRF)
Published: 2026-08-21T02:18Z

References (1)

https://www.ptc.com/en/support/article/CS474826 · 0b655efc-079c-4cb9-9e8d-164871239f4e

EPSS history

Timeline

20 AUG 22:11Z
Server Side Request Forgery (SSRF) vulnerability reported in Windchill
cvelistv5