PTC Patches New Critical Windchill and FlexPLM RCE

PTC has released patches for a new critical remote code execution flaw in Windchill and FlexPLM, tracked as CVE-2026-126325 and scored 9.2 out of 10 on CVSS v4, The Hacker News reports. The report does not say the flaw is exploited in the wild.

What to do: if PTC hosts your Windchill or FlexPLM environment, the patches have already been applied and PTC says no action is required. If you run it yourself, PTC urges you to patch as soon as possible. Where that is not immediately possible, restrict network access to the systems and watch for code execution, backdoor access or web shells on the host.

What is affected

The CVE record describes improper input validation and deserialization of untrusted data, which can lead to remote code execution through crafted requests. Deserialization bugs are a well-worn class: the application rebuilds objects from data an outsider controls, and the rebuilding step can be made to do things the developer never intended.

Affected Windchill versions listed in the record: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0 and 13.1.4.0. FlexPLM is affected across the same list up to 13.1.3.0.

Why this one gets attention

The disclosure comes nearly five months after another critical Windchill and FlexPLM flaw, CVE-2026-12569 (CVSS 9.3), came under active exploitation. In July 2026, threat actors linked to the Cl0p ransomware operation were reported to be using that flaw in a data extortion campaign, dropping JSP web shells and taking product data from manufacturers and industrial enterprises. Our earlier coverage: Windchill RCE on KEV, Clop Hits Windchill and FlexPLM and Clop’s Windchill Implant.

Yordan Ganchev of watchTowr told The Hacker News that PTC software is “a textbook target for initial access brokers and ransomware operators,” with downstream effects on manufacturing, logistics and fulfillment when systems go down.

Analysis: nothing in the reporting says this new flaw is being used, and it would be wrong to imply it. But the same product family was turned into an extortion tool this summer, and PLM servers tend to be patched on a schedule set by engineering change control rather than by security teams. Anyone who spent July cleaning up web shells has a good reason to move this patch to the front of the queue.

More on the vendor is on the PTC hub.