# CVE-2026-126325

Critical RCE via unsafe deserialization in PTC Windchill and FlexPLM.

- Page: https://www.vulneraibility.com/cve/CVE-2026-126325
- CVSS: 9.2
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.51% (percentile 44.2)
- Weakness: CWE-20, CWE-502
- Published: 2026-11-11

## Affected versions

- PTC FlexPLM: affected 11.0 M030; 11.1 M020; 11.2.1.0; 12.0.2.0; 12.1.2.0; 13.0.2.0; 13.1.0.0; 13.1.1.0; 13.1.2.0; 13.1.3.0
- PTC Windchill: affected 11.0 M030; 11.1 M020; 11.2.1.0; 12.0.2.0; 12.1.2.0; 13.0.2.0; 13.1.0.0; 13.1.1.0; 13.1.2.0; 13.1.3.0; 13.1.4.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote code execution via deserialization of untrusted data; attacker can execute arbitrary code, gain server control, access IP and disrupt PLM workflows.

## Action

Immediate action required

## Recommendation

Apply vendor patch immediately; isolate affected servers and audit logs.

## References

- [advisory] https://www.ptc.com/en/support/article/CS483249

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.