Which versions of PTC Windchill are affected by EUVD-2026-37831?

PTC Windchill PDMlink and PTC FlexPLM contain a critical remote code execution vulnerability (CVSS 9.3) exploitable by unauthenticated network attackers without user interaction.

Is there a public PoC exploit available for EUVD-2026-37831?

Yes, a public proof-of-concept exploit is available for EUVD-2026-37831. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate EUVD-2026-37831?

Within 24 hours: Identify and inventory all PTC Windchill PDMlink and FlexPLM deployments; determine which are running versions prior to 11.0 M030 or any CPS version; assess network exposure. Within 7 days: Implement network segmentation to restrict unauthenticated access to affected systems; block external connectivity where operationally feasible; enable detailed access logging on all affected instances. Within 30 days: Engage PTC support for patch availability timeline; evaluate upgrade path to version 11.0 M030 or later; develop contingency plan for potential service disruption if immediate patching is not feasible.

PTC Windchill EUVD-2026-37831

Q: What is the CVSS score of EUVD-2026-37831?

EUVD-2026-37831 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:Red. EPSS exploitation probability: 0.5%.

| CVE-2026-12569 CRITICAL

Improper Input Validation (CWE-20)

2026-06-18 PTC

GHSA-f345-wxwr-fxfh

Deserialization RCE Windchill Pdmlink Flexplm

9.3

CVSS 4.0 · Vendor: PTC

Severity by source

Vendor (PTC) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:Red

vuln.today AI

9.8 CRITICAL

Network-reachable deserialization with no auth or user interaction yields AV:N/AC:L/PR:N/UI:N; RCE in the application context gives full C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (PTC).

CVSS VectorVendor: PTC

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:Red

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Added to CISA KEV

Jun 25, 2026 - 20:03 CISA

Analysis Generated

Jun 18, 2026 - 00:45 vuln.today

DescriptionCVE.org

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions

The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

AnalysisAI

Remote code execution in PTC Windchill PDMlink and PTC FlexPLM allows unauthenticated network attackers to execute arbitrary code via deserialization of untrusted data. All releases prior to 11.0 M030 are affected, as are all CPS versions, and no public exploit identified at time of analysis. Reported by PTC themselves, the flaw carries a CVSS 4.0 base score of 9.3 (critical) reflecting high impact across confidentiality, integrity, and availability without requiring authentication or user interaction.

Technical ContextAI

PTC Windchill PDMlink is an enterprise Product Lifecycle Management (PLM) and Product Data Management platform widely used in manufacturing for managing CAD data, BOMs, and engineering change processes, while FlexPLM extends this for retail/footwear/apparel use cases. Both are Java-based web applications and the vulnerability is rooted in CWE-20 (Improper Input Validation), specifically manifesting as deserialization of untrusted data - an attack class where attacker-controlled serialized objects are reconstructed by the server and can trigger gadget chains in the application classpath that lead to arbitrary code execution. CPE strings confirm both ptc:windchill_pdmlink and ptc:flexplm are in scope across all listed versions.

RemediationAI

Patch available per vendor advisory: upgrade Windchill PDMlink and FlexPLM to 11.0 M030 or later, and apply the corresponding fixed CPS release referenced in PTC support article CS473270 (https://www.ptc.com/en/support/article/CS473270) - exact CPS build numbers should be pulled directly from that advisory as they were not enumerated in the available intelligence. Until patching is completed, restrict network exposure of Windchill/FlexPLM servers by placing them behind a VPN or zero-trust gateway and blocking direct internet access to the HTTP/HTTPS application ports (trade-off: breaks remote supplier and partner access that some PLM deployments rely on). As a secondary control, deploy a WAF rule to inspect and drop requests containing Java serialized object magic bytes (0xACED0005) on Windchill endpoints, accepting that determined attackers may use alternative serialization formats or encoding to bypass signature-based filtering.