CVE-2026-77645: 
Windchill Analyse et atténuation des vulnérabilités

CVE-2026-77645 is a critical remote code execution (RCE) vulnerability affecting PTC Windchill PDMLink and PTC FlexPLM, caused by unsafe deserialization of untrusted data. It was published on August 20, 2026, with a GitHub Advisory (GHSA-qxmv-9q88-wwmw) added on August 21, 2026. Affected versions of Windchill PDMLink include 11.0 M030 through 13.1.3.0, and affected FlexPLM versions include 11.0 M030 through 13.0.3.0. The vulnerability carries a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, ENISA EUVD).

The root cause is improper input validation (CWE-20) combined with deserialization of untrusted data (CWE-502), allowing an attacker to supply maliciously crafted serialized objects to a network-accessible endpoint. The attack vector is network-based, requires no authentication, no user interaction, and no special privileges, though attack complexity is rated High, suggesting some non-trivial precondition or customization is needed to achieve a working exploit. Successful exploitation occurs when the application deserializes attacker-controlled data without adequate type or integrity checks, triggering arbitrary code execution in the context of the application server (GitHub Advisory, ENISA EUVD). No public technical write-up or proof-of-concept code has been identified at this time.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the affected PTC Windchill PDMLink or FlexPLM server, resulting in full compromise of confidentiality, integrity, and availability of the vulnerable system. Given that these platforms manage product lifecycle and engineering data, exploitation could expose sensitive intellectual property, manufacturing data, and supply chain information. Secondary system impact (confidentiality, integrity, availability) is rated Low, indicating some potential for lateral movement or collateral impact on adjacent systems (GitHub Advisory, ENISA EUVD).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (ENISA EUVD). The EPSS score is currently 0.0, reflecting the absence of observed exploitation activity. The vulnerability is rated as automatable (AU:Y) in the CVSS v4.0 supplemental metrics, meaning exploitation could be scripted at scale once a working exploit is developed. No threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

PTC has released a patch addressing this vulnerability, referenced in support article CS474826. Organizations should apply the available security patch immediately for all affected versions of Windchill PDMLink (up to 13.1.3.0) and FlexPLM (up to 13.0.3.0). As interim mitigations, restrict network access to PTC Windchill and FlexPLM services to trusted hosts only, and monitor application logs for suspicious or anomalous deserialization activity (GitHub Advisory, PTC Advisory).

The vulnerability was noted by automated CVE tracking accounts on Bluesky and Mastodon/infosec.exchange shortly after disclosure, and was indexed by multiple threat intelligence aggregators including VulDB, CIRCL, and exploit-intel.com. No significant researcher commentary, vendor blog posts, or major media coverage has been identified beyond standard CVE aggregation (ENISA EUVD).