Skip to content
OpenAdvisories
Critical · 9.3 Known exploited · Ransomware CVE-2026-12569 EUVD-2026-37831GHSA-f345-wxwr-fxfh

Remote Code Execution (RCE) vulnerability in Windchill PDMlink

Published Jun 18, 2026 · Updated Aug 1, 2026 · Assigned by PTC

Vendor: PTC Product: FlexPLM Product: Windchill PDMLink

Description

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory also applies to all CPS versions
* The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

Affected products

VendorProductAffectedFixed
PTC Windchill PDMLink ≤ 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0 —
PTC FlexPLM ≤ 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0 —

Advisories 1

References