Vulnerability · critical · CVSS 9.2
PTC patches critical Windchill and FlexPLM remote code execution flaw
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Windchill and FlexPLM installations
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Remote, no login · Full takeover
What to do
- Apply PTC's patches for Windchill and FlexPLM
The Brief
- PTC has released patches for a critical vulnerability in Windchill and FlexPLM.
- The flaw is tracked as CVE-2026-126325 and carries a CVSS v4 score of 9.2 out of 10.
- If successfully exploited, the flaw could enable remote code execution.
Why it matters
Teams running Windchill or FlexPLM are exposed to remote code execution until they apply PTC's patches.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Windchill and FlexPLM are enterprise PLM software run by engineering and IT teams. |
| No | Core infrastructure | Flaw is in a specific vendor's PLM products, not software nearly every team runs. |
| No | Popular tool | Windchill is a specialized enterprise PLM product, not mainstream developer tech. |
| No | Exploited in the wild | The Hacker News snippet reports no observed attacks using this flaw. |
| No | Public exploit | The Hacker News snippet mentions no published exploit code or PoC. |
| Yes | Remote, no login | CVSSCVE-2026-126325: CVSS 9.2 – network, no privileges, no user interaction |
| Yes | Full takeover | CVSSCVE-2026-126325: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | The Hacker News snippet reports no stolen credentials, data or source code. |
| No | Supply chain | The Hacker News describes a vulnerability, not malicious code shipped through a trusted channel. |
| No | No fix yet | The Hacker News: PTC has released patches for the critical flaw. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-126325 ↗CVSS 9.2 critical AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/RE:M/U:Amber
Critical Remote Code Execution (RCE) vulnerability reported in Windchill
- Exploited
- Not in CISA’s exploited catalog
- Weakness
- CWE-20, CWE-502
Source
PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution ↗ The Hacker News · 2h ago
First seen · 1 source · Full story page · How tiers are decided