EUVD-2026-63755
GHSA-qxmv-9q88-wwmw
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red
Unauthenticated network deserialization RCE gives PR:N and full C:H/I:H/A:H; AC:H reflects the need for a viable gadget chain and specific conditions, scope unchanged.
Primary rating from Vendor (0b655efc-079c-4cb9-9e8d-164871239f4e).
CVSS VectorVendor: 0b655efc-079c-4cb9-9e8d-164871239f4e
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red
Lifecycle Timeline
2DescriptionCVE.org
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
AnalysisAI
Remote code execution in PTC Windchill and PTC FlexPLM allows unauthenticated network attackers to execute arbitrary code by submitting maliciously crafted serialized objects that the application deserializes without validation. Rated CVSS 4.0 9.2 (Critical) with full confidentiality, integrity, and availability impact, though the vector's AC:H flag indicates the attack is non-trivial to reliably reproduce. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N), exploitation is remote and requires no authentication and no user interaction, but is limited by high attack complexity (AC:H) - the attacker must reach an endpoint that deserializes untrusted data and supply a payload that resolves to a usable gadget chain on the target's classpath. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed but lean toward high priority: the CVSS 4.0 base score of 9.2 reflects an unauthenticated (PR:N), network-reachable (AV:N) vector with high impact across all three security properties (VC:H/VI:H/VA:H), and the supplemental metrics flag the issue as Automatable (AU:Y) with a provider urgency of Red (U:Red) and Value Density Concentrated (V:C). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to an exposed Windchill or FlexPLM instance crafts a malicious serialized Java object leveraging a known gadget chain present on the server classpath and submits it to a request-handling endpoint that deserializes untrusted input. When the server reconstructs the object, the gadget chain executes attacker-supplied commands in the context of the application service account. … |
| Remediation | Apply the fix described in the PTC advisory at https://www.ptc.com/en/support/article/CS474826; the input does not include an exact fixed version number, so this is best characterized as patch available per vendor advisory - confirm the specific patched build directly with PTC before scheduling. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Windchill and FlexPLM instances across the organization and document current versions; immediately restrict network access to these systems to authorized personnel only and enable comprehensive logging and monitoring for suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today