PTC Windchill EUVD-2026-63755

Per the CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N), exploitation is remote and requires no authentication and no user interaction, but is limited by high attack complexity (AC:H) - the attacker must reach an endpoint that deserializes untrusted data and supply a payload that resolves to a usable gadget chain on the target's classpath. The description does not name the exact vulnerable feature, endpoint, protocol, or configuration setting beyond 'deserialization of untrusted data,' so the specific trigger surface should be confirmed from the PTC advisory. The primary limiting factors are the AC:H complexity (successful exploitation is not guaranteed on every attempt) and network exposure of the Windchill/FlexPLM instance; instances not reachable from untrusted networks are substantially harder to exploit.

The signals are mixed but lean toward high priority: the CVSS 4.0 base score of 9.2 reflects an unauthenticated (PR:N), network-reachable (AV:N) vector with high impact across all three security properties (VC:H/VI:H/VA:H), and the supplemental metrics flag the issue as Automatable (AU:Y) with a provider urgency of Red (U:Red) and Value Density Concentrated (V:C). Counterbalancing this, the vector specifies AC:H (high attack complexity), meaning successful exploitation is not push-button and likely requires a working gadget chain or specific conditions, which typically depresses real-world exploitation rates. No EPSS score was provided in the input, the CVE is not in CISA KEV, and no POC has been identified, so there is currently no evidence of active or widespread exploitation. Net assessment: a genuine critical-severity RCE that warrants prompt patching in exposed PLM deployments, but the AC:H complexity and absence of a known exploit suggest opportunistic mass exploitation is not yet occurring - prioritize internet-facing instances first.

An attacker with network access to an exposed Windchill or FlexPLM instance crafts a malicious serialized Java object leveraging a known gadget chain present on the server classpath and submits it to a request-handling endpoint that deserializes untrusted input. When the server reconstructs the object, the gadget chain executes attacker-supplied commands in the context of the application service account. The CVSS AC:H rating implies the attacker must first identify a viable gadget chain or satisfy specific runtime conditions, so this is a targeted rather than trivial attack; no public POC has been identified at time of analysis.