Windchill Risk Reliability CVE-2026-77644

Exploitation requires network reachability to a PTC Windchill Risk and Reliability Enterprise Edition instance; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special privileges, and no user interaction are needed against an exposed deployment. The primary limiting factor is exposure scope: instances confined to isolated internal networks or protected behind an enforcing authentication gateway substantially reduce reachability. Exact affected versions and whether a non-default configuration is involved are not specified in the available data and should be verified against PTC advisory CS474818.

The signals align toward a genuine high priority rather than an inflated CVSS: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation with high impact across confidentiality, integrity, and availability, which is fully consistent with a CWE-306 authentication bypass. No EPSS score, SSVC decision, KEV listing, or POC was supplied, so probabilistic and real-world-exploitation signals are absent and cannot corroborate or temper the CVSS-derived severity. Because exploitation requires no privileges or user interaction, any operator running an internet- or intranet-exposed WRR instance - even a mid-sized municipal or plant IT team - should treat patching as urgent while recognizing that the absence of KEV/EPSS data means widespread active exploitation is not confirmed.

An attacker who can reach the WRR application over the network sends requests directly to a critical function endpoint that fails to enforce authentication, gaining access to sensitive reliability data or the ability to alter records without any credentials. Because the CVSS vector indicates no privileges and no user interaction are required, this can be performed by a remote, unauthenticated actor. No public POC was identified at time of analysis.