PTC Windchill PDMLink CVE-2026-77646

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication, no special attack conditions, and no user interaction are required - the vulnerable deserialization endpoint must simply be reachable over the network. The description specifies exploitation occurs through submission of untrusted data for deserialization, meaning the attacker must reach a network-accessible endpoint that accepts and processes serialized input. Exploitation is limited by: (1) network reachability - deployments behind a VPN or internal-only firewall reduce external attack surface significantly; (2) knowledge of the specific deserialization endpoint URL and expected data format; (3) the SSRF impact is bounded by the server's outbound network policy - environments with strict egress controls will experience reduced downstream impact even if the SSRF fires. No non-default configuration is stated as a prerequisite; the vulnerability appears present in standard deployments of the affected products.

The CVSS 4.0 score of 7.7 with AV:N/AC:L/PR:N/UI:N reflects a straightforward, unauthenticated network-reachable attack with low complexity - an attacker needs only to reach the application endpoint and submit a crafted payload. The SC:H subsequent-system confidentiality impact aligns with SSRF's typical capability to probe and exfiltrate data from internal services (metadata APIs, internal REST endpoints, LDAP, database management interfaces) not otherwise exposed to the internet. Because PLM platforms like Windchill are commonly deployed behind corporate VPNs or in segmented DMZs, internet-exposed instances may be fewer in number, but internal-network attackers or those who have achieved a foothold represent a realistic threat class. No EPSS data was provided, and the absence of a KEV listing or known POC means exploitation likelihood cannot be quantified precisely - this is inferred risk, not confirmed active exploitation. The deserialization-as-SSRF-trigger pattern is well-documented in the Java ecosystem, meaning skilled attackers familiar with PLM platform internals could develop working exploits without novel research. Even a moderately resourced attacker targeting manufacturing supply-chain environments should be assumed capable of exploiting this class of vulnerability once an exposed endpoint is identified.

An unauthenticated remote attacker submits an HTTP request to a Windchill PDMLink deserialization endpoint containing a crafted serialized payload embedding a URL fetch gadget chain. The application deserializes the payload, triggering an outbound HTTP request from the Windchill server to an internal resource - such as a cloud instance metadata endpoint or an internal microservice - and the response content is surfaced back to the attacker, exposing credentials, internal network topology, or sensitive configuration data.