CVE-2026-4681

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4681", "assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e", "state": "PUBLISHED", "assignerShortName": "PTC", "dateReserved": "2026-03-23T21:42:24.158Z", "datePublished": "2026-03-23T21:48:05.652Z", "dateUpdated": "2026-03-24T14:49:43.425Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e", "shortName": "PTC", "dateUpdated": "2026-03-23T21:48:05.652Z"}, "title": "Critical Remote Code Execution vulnerability reported in Windchill", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"vendor": "PTC", "product": "Windchill PDMLink", "versions": [{"status": "affected", "version": "11.0 M030", "versionType": "semver"}, {"status": "affected", "version": "11.1 M020", "versionType": "semver"}, {"status": "affected", "version": "11.2.1.0", "versionType": "semver"}, {"status": "affected", "version": "12.0.2.0", "versionType": "semver"}, {"status": "affected", "version": "12.1.2.0", "versionType": "semver"}, {"status": "affected", "version": "13.0.2.0", "versionType": "semver"}, {"status": "affected", "version": "13.1.0.0"}, {"status": "affected", "version": "13.1.1.0"}, {"status": "affected", "version": "13.1.2.0"}, {"status": "affected", "version": "13.1.3.0"}], "defaultStatus": "unknown"}, {"vendor": "PTC", "product": "FlexPLM", "versions": [{"status": "affected", "version": "11.0 M030"}, {"status": "affected", "version": "11.1 M020"}, {"status": "affected", "version": "11.2.1.0"}, {"status": "affected", "version": "12.0.0.0"}, {"status": "affected", "version": "12.0.2.0"}, {"status": "affected", "version": "12.0.3.0"}, {"status": "affected", "version": "12.1.2.0"}, {"status": "affected", "version": "12.1.3.0"}, {"status": "affected", "version": "13.0.2.0"}, {"status": "affected", "version": "13.0.3.0"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\n\nThis issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><span>A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.</span></div><div><p>This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.</p></div>"}]}], "references": [{"url": "https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability?srsltid=AfmBOop3e7Nthx5-BsrjKdpZi50wL6l6Bt21Fz0gUub2cIPgdPGV5bNl", "tags": ["vendor-advisory", "mitigation"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "USER", "valueDensity": "CONCENTRATED", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "RED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T14:48:53.854433Z", "id": "CVE-2026-4681", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:49:43.425Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4681", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-24T14:48:53.854433Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:49:30.805Z"}}], "cna": {"title": "Critical Remote Code Execution vulnerability reported in Windchill", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 9.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PTC", "product": "Windchill PDMLink", "versions": [{"status": "affected", "version": "11.0 M030", "versionType": "semver"}, {"status": "affected", "version": "11.1 M020", "versionType": "semver"}, {"status": "affected", "version": "11.2.1.0", "versionType": "semver"}, {"status": "affected", "version": "12.0.2.0", "versionType": "semver"}, {"status": "affected", "version": "12.1.2.0", "versionType": "semver"}, {"status": "affected", "version": "13.0.2.0", "versionType": "semver"}, {"status": "affected", "version": "13.1.0.0"}, {"status": "affected", "version": "13.1.1.0"}, {"status": "affected", "version": "13.1.2.0"}, {"status": "affected", "version": "13.1.3.0"}], "defaultStatus": "unknown"}, {"vendor": "PTC", "product": "FlexPLM", "versions": [{"status": "affected", "version": "11.0 M030"}, {"status": "affected", "version": "11.1 M020"}, {"status": "affected", "version": "11.2.1.0"}, {"status": "affected", "version": "12.0.0.0"}, {"status": "affected", "version": "12.0.2.0"}, {"status": "affected", "version": "12.0.3.0"}, {"status": "affected", "version": "12.1.2.0"}, {"status": "affected", "version": "12.1.3.0"}, {"status": "affected", "version": "13.0.2.0"}, {"status": "affected", "version": "13.0.3.0"}], "defaultStatus": "unknown"}], "references": [{"url": "https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability?srsltid=AfmBOop3e7Nthx5-BsrjKdpZi50wL6l6Bt21Fz0gUub2cIPgdPGV5bNl", "tags": ["vendor-advisory", "mitigation"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\n\nThis issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.", "supportingMedia": [{"type": "text/html", "value": "<div><span>A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.</span></div><div><p>This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.</p></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e", "shortName": "PTC", "dateUpdated": "2026-03-23T21:48:05.652Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4681", "state": "PUBLISHED", "dateUpdated": "2026-03-24T14:49:43.425Z", "dateReserved": "2026-03-23T21:42:24.158Z", "assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e", "datePublished": "2026-03-23T21:48:05.652Z", "assignerShortName": "PTC"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Windchill PDMLink", "vendor": "PTC", "versions": [{"status": "affected", "version": "11.0 M030", "versionType": "semver"}, {"status": "affected", "version": "11.1 M020", "versionType": "semver"}, {"status": "affected", "version": "11.2.1.0", "versionType": "semver"}, {"status": "affected", "version": "12.0.2.0", "versionType": "semver"}, {"status": "affected", "version": "12.1.2.0", "versionType": "semver"}, {"status": "affected", "version": "13.0.2.0", "versionType": "semver"}, {"status": "affected", "version": "13.1.0.0"}, {"status": "affected", "version": "13.1.1.0"}, {"status": "affected", "version": "13.1.2.0"}, {"status": "affected", "version": "13.1.3.0"}]}, {"defaultStatus": "unknown", "product": "FlexPLM", "vendor": "PTC", "versions": [{"status": "affected", "version": "11.0 M030"}, {"status": "affected", "version": "11.1 M020"}, {"status": "affected", "version": "11.2.1.0"}, {"status": "affected", "version": "12.0.0.0"}, {"status": "affected", "version": "12.0.2.0"}, {"status": "affected", "version": "12.0.3.0"}, {"status": "affected", "version": "12.1.2.0"}, {"status": "affected", "version": "12.1.3.0"}, {"status": "affected", "version": "13.0.2.0"}, {"status": "affected", "version": "13.0.3.0"}]}], "source": "0b655efc-079c-4cb9-9e8d-164871239f4e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\n\nThis issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0."}, {"lang": "es", "value": "Una vulnerabilidad cr\u00edtica de ejecuci\u00f3n remota de c\u00f3digo (RCE) ha sido reportada en PTC Windchill y PTC FlexPLM. La vulnerabilidad puede ser explotada a trav\u00e9s de la deserializaci\u00f3n de datos no confiables.\n\nEste problema afecta a Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0."}], "id": "CVE-2026-4681", "lastModified": "2026-06-17T10:57:01.310", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "0b655efc-079c-4cb9-9e8d-164871239f4e", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4681", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T14:48:53.854433Z", "version": "2.0.3"}}]}, "published": "2026-03-23T22:16:31.890", "references": [{"source": "0b655efc-079c-4cb9-9e8d-164871239f4e", "url": "https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability?srsltid=AfmBOop3e7Nthx5-BsrjKdpZi50wL6l6Bt21Fz0gUub2cIPgdPGV5bNl"}], "sourceIdentifier": "0b655efc-079c-4cb9-9e8d-164871239f4e", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "0b655efc-079c-4cb9-9e8d-164871239f4e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.0 M030"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.1 M020"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.2.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.0.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.0.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.0.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.1.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.1.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.0.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.0.3.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "FlexPLM", "source": "cna", "vendor": "PTC"}, "product": "flexplm", "vendor": "ptc"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.0 M030"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.1 M020"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.2.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.0.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.1.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.0.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.1.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.1.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.1.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.1.3.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Windchill PDMLink", "source": "cna", "vendor": "PTC"}, "product": "windchill_pdmlink", "vendor": "ptc"}], "analysis": {"en": {"generated_at": "2026-03-24T03:56:34.872029+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011released patch or upgrade PTC Windchill and FlexPLM to a fixed version that resolves the unsafe deserialization flaw.", "If a formal patch is not yet available, isolate the affected systems from external network access and monitor for anomalous traffic or attempts to exploit deserialization.", "Verify that the application does not accept serialized objects from unauthenticated sources and enforce strict validation of deserialized data."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects PTC Windchill PDMLink versions 11.0\u202fM030, 11.1\u202fM020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, and 13.1.3.0, as well as PTC FlexPLM versions 11.0\u202fM030, 11.1\u202fM020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, and 13.0.3.0.", "description_and_impact": "A remote code execution vulnerability arises from the deserialization of untrusted data in PTC Windchill and FlexPLM. The flaw is classified as CWE\u201194 and can enable an attacker to run arbitrary code with the privileges of the application, leading to a full compromise of confidentiality, integrity, and availability of the affected systems. The high CVSS score of 9.3 reflects the severity of this issue.", "risk_and_exploitability": "The CVSS base score of 9.3 indicates a critical risk level. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog, but the nature of the flaw\u2014remote deserialization\u2014suggests that an attacker who can send crafted data to the affected applications may trigger arbitrary code execution. Exploitation requires remote access but does not rely on local privileges, making it potentially reachable from external network traffic."}}}}, "created": "2026-03-24T10:30:09.569275+00:00", "updated": "2026-03-25T20:36:17.431008+00:00", "vendors": ["ptc", "ptc$PRODUCT$flexplm", "ptc$PRODUCT$windchill_pdmlink"]}