PTC Windchill: RCE vuln

PTC Windchill

PTC patches critical vulnerability in Windchill and FlexPLM software, allowing remote code execution.

Do this now

Check PTC's advisory for a Windchill and FlexPLM fix and restrict network access to these systems meanwhile.

Still cooking for Windchill and FlexPLM.

First seen: 12 Nov 2026
Last update: 12 Nov 2026, 13:19 UTC
Identifiers: CVE-2026-126325
CVSS: 9.0
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## PTC Windchill: RCE vuln
Severity: critical. Patch status: fix status unknown.
Affected: PTC Windchill
Ids: CVE-2026-126325

PTC patches critical vulnerability in Windchill and FlexPLM software, allowing remote code execution.

## Steps
1. Search the repo, its CI and infra config for PTC Windchill. If present, report the version in use and whether it's affected.
2. Windchill 13.1.x, 13.0.x, 12.1.x, 12.0.x, 11.2.x, 11.1.x, 11.0.x; FlexPLM 13.1.x, 13.0.x, 12.1.x, 12.0.x, 11.2.x, 11.1.x, 11.0.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Windchill 11.0 to 13.1 (7 lines) | not named in the CVE record | check the vendor advisory | restrict network access to it |
| FlexPLM 11.0 to 13.1 (7 lines) | not named in the CVE record | check the vendor advisory | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-126325") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html
https://pwned.coffee/i/ptc-windchill-rce-vuln-cve-2026-126325

Timeline

12 Nov 2026, 13:19 UTC
Fix status: patched → unknown.
12 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Windchill 11.0 M030 to 13.1.0.0 (7 lines) fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 13 Nov
FlexPLM 11.0 M030 to 13.1.0.0 (7 lines) fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 13 Nov
Score: CVSS 9.0 (critical). CVSS 3.1 9 (CNA PTC) for CVE-2026-126325
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Fixed in	Source
Windchill	11.0 M030 to 13.1.0.0 (7 lines)	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 13 Nov
FlexPLM	11.0 M030 to 13.1.0.0 (7 lines)	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 13 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

feeds.feedburner.com: PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution

Follow on X

Totalone very hot coffee