CVE-2026-77645
Full vulnerability record from the local CVENow database.
Description
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
Severity
CRITICAL
CVSS score
9.2
(v4.0)
Vulnerability status
Deferred
Source identifier
0b655efc-079c-4cb9-9e8d-164871239f4e
Published
2026-08-20 22:18:06.510000
Last modified
2026-10-26 10:10:00.140000
View original CVE JSON
{
"id": "CVE-2026-77645",
"sourceIdentifier": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"published": "2026-08-20T22:18:06.510",
"lastModified": "2026-10-26T10:10:00.140",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data."
},
{
"lang": "es",
"value": "Una crítica vulnerabilidad de ejecución remota de código (RCE) ha sido reportada en PTC Windchill y PTC FlexPLM. La vulnerabilidad puede ser explotada a través de la deserialización de datos no confiables."
}
],
"affected": [
{
"source": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"affectedData": [
{
"vendor": "PTC",
"product": "Windchill PDMLink",
"defaultStatus": "unaffected",
"versions": [
{
"version": "11.0 M030",
"status": "affected"
},
{
"version": "11.1 M020",
"status": "affected"
},
{
"version": "11.2.1.0",
"status": "affected"
},
{
"version": "12.0.2.0",
"status": "affected"
},
{
"version": "12.1.2.0",
"status": "affected"
},
{
"version": "13.0.2.0",
"status": "affected"
},
{
"version": "13.1.0.0",
"status": "affected"
},
{
"version": "13.1.1.0",
"status": "affected"
},
{
"version": "13.1.2.0",
"status": "affected"
},
{
"version": "13.1.3.0",
"status": "affected"
}
]
},
{
"vendor": "PTC",
"product": "FlexPLM",
"defaultStatus": "unaffected",
"versions": [
{
"version": "11.0 M030",
"status": "affected"
},
{
"version": "11.1 M020",
"status": "affected"
},
{
"version": "11.2.1.0",
"status": "affected"
},
{
"version": "12.0.0.0",
"status": "affected"
},
{
"version": "12.0.2.0",
"status": "affected"
},
{
"version": "12.0.3.0",
"status": "affected"
},
{
"version": "12.1.2.0",
"status": "affected"
},
{
"version": "12.1.3.0",
"status": "affected"
},
{
"version": "13.0.2.0",
"status": "affected"
},
{
"version": "13.0.3.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "LOW",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "YES",
"Recovery": "USER",
"valueDensity": "CONCENTRATED",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "RED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-21T00:00:00+00:00",
"id": "CVE-2026-77645",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-20"
},
{
"lang": "en",
"value": "CWE-502"
}
]
}
],
"references": [
{
"url": "https://www.ptc.com/en/support/article/CS474826",
"source": "0b655efc-079c-4cb9-9e8d-164871239f4e"
}
]
}