What is the CVSS score of CVE-2026-4681?

CVE-2026-4681 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red. EPSS exploitation probability: 0.4%.

Which versions of Windchill Pdmlink are affected by CVE-2026-4681?

Organizations using PTC Windchill and PTC FlexPLM. The vulnerability may be exploited face critical risk from CVE-2026-4681, a code injection vulnerability rated CVSS 9.3.

Is there a public PoC exploit available for CVE-2026-4681?

Yes, a public proof-of-concept exploit is available for CVE-2026-4681. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-4681?

Within 24 hours: Identify all affected systems running PTC Windchill and PTC FlexPLM. The vulnerability may be expl and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Windchill Pdmlink CVE-2026-4681

EUVD-2026-14606 CRITICAL

Code Injection (CWE-94)

2026-03-23 PTC

GHSA-jfrx-fmg3-3p8m

RCE Deserialization Windchill Pdmlink Flexplm

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Started Trending

Mar 31, 2026 - 11:23 vuln.today

8.0

PoC Detected

Mar 24, 2026 - 15:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 22:15 euvd

EUVD-2026-14606

Analysis Generated

Mar 23, 2026 - 22:15 vuln.today

CVE Published

Mar 23, 2026 - 21:48 nvd

CRITICAL 9.3

DescriptionCVE.org

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.

Articles & Coverage 1

thecyberexpress.com Kali Forms WordPress Plugin RCE CVE-2026-1490: Active Exploitation After Public Disclosure Apr 14, 2026

AnalysisAI

A critical remote code execution vulnerability exists in PTC Windchill PDMLink and PTC FlexPLM products due to unsafe deserialization of untrusted data, allowing unauthenticated attackers to execute arbitrary code on affected systems. The vulnerability affects multiple versions of both products spanning from version 11.0 through 13.1.3.0 for Windchill and 11.0 through 13.0.3.0 for FlexPLM. An attacker can craft malicious serialized objects that, when deserialized by the vulnerable application, trigger code execution with the privileges of the Windchill or FlexPLM service account.

Technical ContextAI

This vulnerability is rooted in CWE-94 (Code Injection), specifically the unsafe deserialization pattern common in Java applications that use native serialization or third-party serialization libraries. PTC Windchill PDMLink and FlexPLM, as confirmed by their CPE identifiers (cpe:2.3:a:ptc:windchill_pdmlink:*:*:*:*:*:*:*:* and cpe:2.3:a:ptc:flexplm:*:*:*:*:*:*:*:*), are enterprise product lifecycle management (PLM) platforms built on Java technology that likely accept serialized objects through web services or API endpoints. The deserialization of untrusted data without proper validation allows gadget chain exploitation, where pre-existing classes in the application's classpath can be chained together to achieve arbitrary code execution. This attack vector is particularly dangerous in PLM systems that process external documents and data feeds as part of normal operations.

RemediationAI

Organizations must immediately apply security patches provided by PTC for affected Windchill PDMLink and FlexPLM versions; specific patch versions and availability should be confirmed at PTC's advisory center (https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability). Until patches can be deployed, implement compensating controls by restricting network access to Windchill and FlexPLM instances to trusted internal networks only, disabling external API endpoints if not in active use, and deploying a Web Application Firewall (WAF) configured to block serialized Java object patterns in request payloads. Monitor application logs and network traffic for signs of exploitation, specifically unusual deserialization activity or outbound connections from Windchill/FlexPLM service accounts. Prioritize patching based on criticality of the systems and their network exposure, applying patches to externally-facing instances first.