Skip to content
OpenAdvisories

Vendor

PTC

32 known vulnerabilities.

Products

ThingWorx Kepware Server 8 ThingWorx Industrial Connectivity 8 Kepware KEPServerEX 7 Axeda agent 7 Axeda Desktop Server for Windows 7 Vuforia Studio 6 FlexPLM 5 Windchill PDMLink 4 ThingWorx Kepware Edge 4 KEPServerEX 3 ThingWorx Edge C-SDK 2 ThingWorx Edge MicroServer (EMS) 2 Codebeamer 2 OPC-Aggregator 2 Creo Elements/Direct License 1 Windchill 1 Kepware ThingWorx Kepware Server 1 Windchill Risk and Reliability Enterprise Edition (Formerly Relex) 1 Kepware LinkMaster 0 Rockwell Automation KEPServer Enterprise 0 GE Digital Industrial Gateway Server 0 Software Toolbox TOP Server 0 ThingWorkx Industrial Connectivity 0 ThingWorkx Kepware Edge 0 ThingWorkx Kepware Server 0 Codebeamer 22.10.X 0 Codebeamer 22.04.X 0 Codebeamer 21.09.X 0 .NET-SDK 0 ThingWorx Kepware Server (formerly ThingWorx Industrial Connectivity) 0 Creo Elements/Direct Drafting 0 Creo Elements/Direct Model Manager / Drawing Manager 0 Creo Elements/Direct Modeling 0 Creo Elements/Direct WorkManager / DDM 0 GE IGS 0 Creo Elements/Direct License Server (MEls) 0
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-126325

    Critical Remote Code Execution (RCE) vulnerability reported in Windchill

    A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

    PTC FlexPLM Windchill
  • Critical 9.2
    CVE-2026-77645

    Critical Remote Code Execution (RCE) vulnerability reported in Windchill

    A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

    PTC FlexPLM Windchill PDMLink
  • Critical 9.3
    CVE-2026-77644

    Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition

    A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition.

    PTC Windchill Risk and Reliability Enterprise Edition (Formerly Relex)
  • Critical 9.3
    CVE-2026-12569 Exploited · Ransomware EPSS 46%

    Remote Code Execution (RCE) vulnerability in Windchill PDMlink

    A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory also applies to all CPS versions * The identifi…

    PTC FlexPLM Windchill PDMLink
    KEV Jun 25, 2026
  • Critical 9.3
    CVE-2026-4681

    Critical Remote Code Execution vulnerability reported in Windchill

    A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12…

    PTC FlexPLM Windchill PDMLink
  • Critical 10.0
    CVE-2024-6071

    PTC Creo Elements/Direct License Server Missing Authorization

    PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server.

    PTC Creo Elements/Direct License
  • Critical 9.1
    CVE-2023-5908

    Heap Based Buffer Overflow in PTC KEPServerEx

    KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.

    Rockwell Automation PTC Software Toolbox GE Gigital Browsers ICS / OT
  • Critical 9.8
    CVE-2023-0754

    The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to crash the …

    Microsoft Rockwell Automation PTC General Electric Browsers ICS / OT
  • Critical 9.8
    CVE-2023-0755 EPSS 12%

    The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash t…

    Microsoft Rockwell Automation PTC General Electric Browsers ICS / OT
  • Critical 9.8
    CVE-2022-25251

    PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

    When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific port without proper authentication. Successful exploitation of this vulnerability…

    PTC Axeda Desktop Server for Windows Axeda agent Windows
  • Critical 9.8
    CVE-2022-25246

    PTC Axeda agent and Axeda Desktop Server Use of Hard-Coded Credentials

    Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitation of this vulnerability could allow a remote authenticated attacker to take full remote control of …

    PTC Axeda Desktop Server for Windows Axeda agent Windows
  • Critical 9.8
    CVE-2022-25247

    PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

    Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacke…

    PTC Axeda agent Axeda Desktop Server for Windows Windows