EUVD-2026-63756
GHSA-2698-qwmx-3r6f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red
Network-accessible, unauthenticated, no user interaction; scope changes to subsequent internal systems with high confidentiality impact via SSRF; no integrity or availability impact on the vulnerable system itself.
Primary rating from Vendor (0b655efc-079c-4cb9-9e8d-164871239f4e).
CVSS VectorVendor: 0b655efc-079c-4cb9-9e8d-164871239f4e
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red
Lifecycle Timeline
2DescriptionCVE.org
A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
AnalysisAI
Server-Side Request Forgery in PTC Windchill PDMLink and PTC FlexPLM allows unauthenticated remote attackers to induce the server to issue arbitrary internal network requests by submitting maliciously crafted serialized data for deserialization. The underlying root cause is CWE-502 (Deserialization of Untrusted Data), where the deserialization process itself is the vector that triggers the SSRF condition, enabling lateral movement toward backend infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication, no special attack conditions, and no user interaction are required - the vulnerable deserialization endpoint must simply be reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.7 with AV:N/AC:L/PR:N/UI:N reflects a straightforward, unauthenticated network-reachable attack with low complexity - an attacker needs only to reach the application endpoint and submit a crafted payload. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker submits an HTTP request to a Windchill PDMLink deserialization endpoint containing a crafted serialized payload embedding a URL fetch gadget chain. The application deserializes the payload, triggering an outbound HTTP request from the Windchill server to an internal resource - such as a cloud instance metadata endpoint or an internal microservice - and the response content is surfaced back to the attacker, exposing credentials, internal network topology, or sensitive configuration data. |
| Remediation | Consult the PTC vendor advisory at https://www.ptc.com/en/support/article/CS474826 for patch or hotfix details; no exact fix version was present in the available intelligence data so a specific patched release cannot be independently confirmed here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all PTC Windchill PDMLink and FlexPLM deployments to identify internet-exposed instances; immediately restrict network access to these systems and deploy Web Application Firewall rules blocking suspicious serialized data patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today