PTC Patches Critical Vulnerability in Windchill and FlexPLM Software
PTC has issued patches for a critical vulnerability in Windchill and FlexPLM software, tracked as CVE-2026-126325. Exploitation has been reported, urging organizations to apply updates promptly.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
PTC released patches for a critical vulnerability in Windchill and FlexPLM.
Who is affected
Windchill versions 11.0 M030 to 13.1.4.0; FlexPLM versions 11.0 M030 to 13.1.3.0.
Exploited
Exploitation reported.
What to do
Apply patches urgently if not hosted by PTC.
PTC has released patches addressing a critical vulnerability in its Windchill and FlexPLM software. The vulnerability, identified as CVE-2026-126325, has been assigned a CVSS v4 score of 9.2, indicating its severity.
The flaw involves improper input validation and deserialization of untrusted data, affecting Windchill versions 11.0 M030 to 13.1.4.0 and FlexPLM versions 11.0 M030 to 13.1.3.0. PTC has automatically patched systems it hosts, but other users must urgently apply the patch.
Exploitation of this vulnerability has been reported, with experts warning that PTC software is a prime target for ransomware and initial access brokers. This follows a previous critical RCE issue (CVE-2026-12569) linked to Cl0p ransomware operations.
Organizations using PTC Windchill and FlexPLM products are advised to patch exposed systems as soon as possible to mitigate potential risks.
