{"id":"CVE-2026-4681","state":"PUBLISHED","title":"Critical Remote Code Execution vulnerability reported in Windchill","description":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\n\nThis issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.","publishedAt":"2026-03-23T21:48:05.652Z","updatedAt":"2026-03-24T14:49:43.425Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red","source":"PTC"},"assigner":"PTC","products":["PTC Windchill PDMLink","PTC FlexPLM"],"affected":[{"vendor":"PTC","product":"Windchill PDMLink","defaultStatus":"unknown","versions":[{"version":"11.0 M030","status":"affected","versionType":"semver"},{"version":"11.1 M020","status":"affected","versionType":"semver"},{"version":"11.2.1.0","status":"affected","versionType":"semver"},{"version":"12.0.2.0","status":"affected","versionType":"semver"},{"version":"12.1.2.0","status":"affected","versionType":"semver"},{"version":"13.0.2.0","status":"affected","versionType":"semver"},{"version":"13.1.0.0","status":"affected"},{"version":"13.1.1.0","status":"affected"},{"version":"13.1.2.0","status":"affected"},{"version":"13.1.3.0","status":"affected"}]},{"vendor":"PTC","product":"FlexPLM","defaultStatus":"unknown","versions":[{"version":"11.0 M030","status":"affected"},{"version":"11.1 M020","status":"affected"},{"version":"11.2.1.0","status":"affected"},{"version":"12.0.0.0","status":"affected"},{"version":"12.0.2.0","status":"affected"},{"version":"12.0.3.0","status":"affected"},{"version":"12.1.2.0","status":"affected"},{"version":"12.1.3.0","status":"affected"},{"version":"13.0.2.0","status":"affected"},{"version":"13.0.3.0","status":"affected"}]}],"references":["https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability?srsltid=AfmBOop3e7Nthx5-BsrjKdpZi50wL6l6Bt21Fz0gUub2cIPgdPGV5bNl"],"weaknesses":["CWE-94"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/4xxx/CVE-2026-4681.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-4681","state":"PUBLISHED","datePublished":"2026-03-23T21:48:05.652Z","dateUpdated":"2026-03-24T14:49:43.425Z","assignerShortName":"PTC","assignerOrgId":"0b655efc-079c-4cb9-9e8d-164871239f4e","dateReserved":"2026-03-23T21:42:24.158Z"},"containers":{"cna":{"title":"Critical Remote Code Execution vulnerability reported in Windchill","descriptions":[{"lang":"en","value":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\n\nThis issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0."}],"affected":[{"vendor":"PTC","product":"Windchill PDMLink","defaultStatus":"unknown","versions":[{"version":"11.0 M030","status":"affected","versionType":"semver"},{"version":"11.1 M020","status":"affected","versionType":"semver"},{"version":"11.2.1.0","status":"affected","versionType":"semver"},{"version":"12.0.2.0","status":"affected","versionType":"semver"},{"version":"12.1.2.0","status":"affected","versionType":"semver"},{"version":"13.0.2.0","status":"affected","versionType":"semver"},{"version":"13.1.0.0","status":"affected"},{"version":"13.1.1.0","status":"affected"},{"version":"13.1.2.0","status":"affected"},{"version":"13.1.3.0","status":"affected"}]},{"vendor":"PTC","product":"FlexPLM","defaultStatus":"unknown","versions":[{"version":"11.0 M030","status":"affected"},{"version":"11.1 M020","status":"affected"},{"version":"11.2.1.0","status":"affected"},{"version":"12.0.0.0","status":"affected"},{"version":"12.0.2.0","status":"affected"},{"version":"12.0.3.0","status":"affected"},{"version":"12.1.2.0","status":"affected"},{"version":"12.1.3.0","status":"affected"},{"version":"13.0.2.0","status":"affected"},{"version":"13.0.3.0","status":"affected"}]}],"references":[{"url":"https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability?srsltid=AfmBOop3e7Nthx5-BsrjKdpZi50wL6l6Bt21Fz0gUub2cIPgdPGV5bNl","tags":["vendor-advisory","mitigation"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"USER","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"RED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","lang":"en","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"PTC","orgId":"0b655efc-079c-4cb9-9e8d-164871239f4e","dateUpdated":"2026-03-23T21:48:05.652Z"},"impacts":[{"capecId":"CAPEC-242","descriptions":[{"lang":"en","value":"CAPEC-242 Code Injection"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-24T14:48:53.854433Z","id":"CVE-2026-4681","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-24T14:49:43.425Z"}}]}}}