Critical PTC Windchill RCE Flaw CVE-2026-126325 Patched
PTC released a fix for a critical flaw in its Windchill and FlexPLM product lifecycle software, tracked as `CVE-2026-126325` (CVSS 9.2), that could allow remote code execution through crafted requests.
⚡ Why it matters
PTC software holds manufacturers' designs and trade secrets, and the Cl0p gang exploited a similar flaw this year to steal and extort industrial data.
The flaw stems from improper input validation and deserialization of untrusted data, which can lead to remote code execution (RCE).
Affected versions
- Windchill: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, and 13.1.0.0 through 13.1.4.0.
- FlexPLM: largely the same versions, up to 13.1.3.0.
PTC says it has already patched environments it hosts. Customers running their own servers should apply the patch as soon as possible.
Why the urgency
About five months ago, another critical Windchill and FlexPLM RCE flaw (CVE-2026-12569) was exploited in the wild. In July 2026, actors linked to Cl0p were found using it in an extortion campaign that dropped JSP web shells and stole product data from industrial companies. watchTowr describes PTC products as a classic target for ransomware crews and the brokers who sell them initial access.
What to do
- Patch every self-hosted Windchill or FlexPLM server now.
- Keep the server off the open internet, behind a VPN or access gateway.
- Check for unexpected JSP files or unusual data export activity.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Critical CVEs: Synology, SharePoint, VS Code and Routers
Here are the most important critical vulnerabilities published in the US NVD between November 9 and 15, 2026, from Synology and Microsoft to developer tools, WordPress plugins and old home routers, with what to do for each.
Claude 'Office Party' Skills Flaw Runs Code on Linux
AIR Security disclosed Office Party, a flaw in Claude's official Word, PowerPoint and Excel skills that can run malicious code on Linux once a file is planted in a shared temp folder. Anthropic has chosen not to fix it.
Windows Paint Flaw CVE-2026-83844: Update via the Store
Microsoft patched a remote code execution flaw, `CVE-2026-83844`, in Windows Paint after nearly a month of confusion over the fixed version and its Store availability. The safe version is 11.2609.401.0.