PTC patches Windchill and FlexPLM flaw enabling remote code execution

PTC says it has issued patches for a critical remote code execution flaw affecting Windchill and FlexPLM, tracked as CVE-2026-126325, with a CVSS v4 score of 9.2. The vulnerability stems from improper input validation and deserialization of untrusted data, which could enable an attacker to execute arbitrary code via crafted requests.

The CVE record lists affected versions for Windchill as 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2[.]0, 13.0.2[.]0, 13.1.0[.]0, 13.1.1[.]0, 13.1.2[.]0, 13.1.3[.]0, and 13.1.4[.]0, and for FlexPLM as 11.0 M030, 11.1 M020, 11.2.1[.]0, 12.0.2[.]0, 12.1.2[.]0, 13.0.2[.]0, 13.1.0[.]0, 13.1.1[.]0, 13.1.2[.]0, and 13.1.3[.]0. The firm notes that environments hosted by PTC are patched on its behalf, while others should apply the fixes promptly to protect their systems, the advisory states.

The disclosure follows a prior critical Windchill/FlexPLM RCE issue (CVE-2026-12569) that was under active exploitation, and investigations indicated threat actors affiliated with Cl0p weaponised Windchill/FlexPLM to drop JSP shells and exfiltrate data. Security firm commentators warn that the flaw could enable broad internal access and downstream manufacturing disruptions.

PTC cautions organisations to patch exposed installations as soon as possible and to monitor for indicators of code execution or web shells, with network restrictions as a compensating control if patching is not immediate. The Hacker News attributes these observations to PTC, CVE[.]org, and researchers including Yordan Ganchev of watchTowr.