CVE-2026-77646
Full vulnerability record from the local CVENow database.
Description
A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
Severity
HIGH
CVSS score
7.7
(v4.0)
Vulnerability status
Deferred
Source identifier
0b655efc-079c-4cb9-9e8d-164871239f4e
Published
2026-08-20 22:18:06.657000
Last modified
2026-10-26 10:10:00.140000
View original CVE JSON
{
"id": "CVE-2026-77646",
"sourceIdentifier": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"published": "2026-08-20T22:18:06.657",
"lastModified": "2026-10-26T10:10:00.140",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data."
},
{
"lang": "es",
"value": "Una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) ha sido reportada en PTC Windchill PDMLink y PTC FlexPLM. La vulnerabilidad puede ser explotada a través de la deserialización de datos no confiables."
}
],
"affected": [
{
"source": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"affectedData": [
{
"vendor": "PTC",
"product": "Windchill PDMLink",
"defaultStatus": "unaffected",
"versions": [
{
"version": "11.0 M030",
"status": "affected"
},
{
"version": "11.1 M020",
"status": "affected"
},
{
"version": "11.2.1.0",
"status": "affected"
},
{
"version": "12.0.2.0",
"status": "affected"
},
{
"version": "12.1.2.0",
"status": "affected"
},
{
"version": "13.0.2.0",
"status": "affected"
},
{
"version": "13.1.0.0",
"status": "affected"
},
{
"version": "13.1.1.0",
"status": "affected"
},
{
"version": "13.1.2.0",
"status": "affected"
},
{
"version": "13.1.3.0",
"status": "affected"
}
]
},
{
"vendor": "PTC",
"product": "FlexPLM",
"defaultStatus": "unaffected",
"versions": [
{
"version": "11.0 M030",
"status": "affected"
},
{
"version": "11.1 M020",
"status": "affected"
},
{
"version": "11.2.1.0",
"status": "affected"
},
{
"version": "12.0.0.0",
"status": "affected"
},
{
"version": "12.0.2.0",
"status": "affected"
},
{
"version": "12.0.3.0",
"status": "affected"
},
{
"version": "12.1.2.0",
"status": "affected"
},
{
"version": "12.1.3.0",
"status": "affected"
},
{
"version": "13.0.2.0",
"status": "affected"
},
{
"version": "13.0.3.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "YES",
"Recovery": "USER",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "RED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-21T19:49:33.203565Z",
"id": "CVE-2026-77646",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-502"
},
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"references": [
{
"url": "https://www.ptc.com/en/support/article/CS474826",
"source": "0b655efc-079c-4cb9-9e8d-164871239f4e"
}
]
}