CVE-2026-77646: 
Windchill Analyse et atténuation des vulnérabilités

CVE-2026-77646 is a Server-Side Request Forgery (SSRF) vulnerability affecting PTC Windchill PDMLink and PTC FlexPLM, exploitable through the deserialization of untrusted data (CWE-502, CWE-918). The vulnerability was published on August 20, 2026, and affects multiple versions of both products spanning releases from 11.0 M030 through 13.1.3.0 for Windchill PDMLink, and 11.0 M030 through 13.0.3.0 for FlexPLM. It carries a CVSS v4.0 base score of 7.7 (High), with a provider urgency rating of Red (GitHub Advisory, ENISA EUVD).

The vulnerability is rooted in improper deserialization of untrusted data (CWE-502), which serves as the attack vector to trigger a Server-Side Request Forgery condition (CWE-918). An unauthenticated remote attacker can submit maliciously crafted serialized data to the affected application, causing the server to deserialize it and subsequently issue arbitrary HTTP requests to internal or external systems. No authentication, user interaction, or special attack conditions are required, making the attack fully automatable over the network (GitHub Advisory, ENISA EUVD).

Successful exploitation allows an unauthenticated attacker to make arbitrary HTTP requests originating from the vulnerable server, enabling access to internal services not otherwise reachable from the internet, potential data exfiltration, and lateral movement within the network. The primary impact is on the confidentiality of subsequent/downstream systems (rated High), while the vulnerable system itself shows no direct confidentiality, integrity, or availability impact per the CVSS v4.0 scoring. In environments where Windchill PDMLink or FlexPLM have access to sensitive internal infrastructure — such as product lifecycle management data, engineering designs, or internal APIs — the risk of data exposure and network pivoting is significant (GitHub Advisory, ENISA EUVD).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and is rated as automatable, which lowers the barrier for exploitation if a PoC becomes available.

1. Reconnaissance: Identify internet-facing PTC Windchill PDMLink or FlexPLM instances using tools like Shodan or Censys, targeting affected versions (Windchill PDMLink 11.0 M030 through 13.1.3.0; FlexPLM 11.0 M030 through 13.0.3.0).
2. Craft malicious serialized payload: Construct a malicious Java serialized object designed to trigger an outbound HTTP request to an attacker-controlled or internal target URL upon deserialization.
3. Submit payload: Send the crafted serialized data to a vulnerable endpoint on the target application over the network, without requiring any authentication credentials.
4. Trigger SSRF: The server deserializes the untrusted data, causing it to issue an HTTP request to the attacker-specified internal or external URL — potentially reaching internal services such as metadata APIs, internal databases, or other network resources.
5. Pivot or exfiltrate: Use the SSRF capability to probe internal network topology, access cloud metadata endpoints (e.g., AWS IMDSv1), retrieve sensitive data from internal services, or facilitate further lateral movement (GitHub Advisory, ENISA EUVD).

• Network: Unexpected outbound HTTP/HTTPS requests from the Windchill PDMLink or FlexPLM server to internal IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), or unusual external hosts; anomalous DNS lookups originating from the application server.
• Logs: Application server logs showing deserialization errors or unexpected object instantiation; web server access logs with unusual POST requests to deserialization-handling endpoints containing binary or base64-encoded payloads.
• Process: Unusual network connections initiated by the Java application process (e.g., java) to internal services or non-standard ports not typical for normal PLM operations.
• File System: Unexpected temporary files or cached responses from internal services written to the application's working directory.

PTC has published a support article (CS474826) addressing this vulnerability; organizations should consult it for specific patch guidance and apply available updates promptly (GitHub Advisory). As interim mitigations, implement strict input validation and sanitization for all deserialized data, and disable or restrict Java deserialization of untrusted data where feasible. Apply network segmentation to limit outbound HTTP requests from Windchill PDMLink and FlexPLM servers, and monitor and log all outbound connections from these systems. Restrict access to the affected applications to trusted networks and authenticated users where possible.

The vulnerability received automated coverage from vulnerability tracking platforms including VulDB, CIRCL, and ENISA EUVD shortly after disclosure. A Bluesky post from a CVE tracking account noted the vulnerability's publication. No significant researcher commentary, vendor blog posts, or major media coverage has been identified beyond standard vulnerability database entries as of the time of this report.