PTC Windchill and FlexPLM Improper Input Validation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/06/2026. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| flexplm | = 11.1m020= 11.2.1.0= 12.0.0.0= 12.0.2.0= 12.1.3.0= 13.0.2.0= 13.0.3.0≤ 11.0m030 | |
| windchill pdmlink | = 11.0m030= 11.1m020= 11.2.1.0= 12.0.2.0= 12.1.2.0= 13.0.2.0= 13.1.0.0= 13.1.1.0= 13.1.2.0= 13.1.3.0< 11.0m030 | 11.0m030 |
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free