PTC has published CVE-2026-126325, a critical remote code execution vulnerability in PTC Windchill and PTC FlexPLM that, the CNA says, "may be exploited through the deserialization of untrusted data." The PTC CNA scores it CVSS 4.0 9.2 Critical (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/RE:M/U:Amber) and CVSS 3.1 9.0 Critical (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). NVD lists the record as Received and republishes those CNA scores as Secondary; it has not published an NVD Primary score.
This is a new advisory on a new CVE. It is not an update of our earlier post on the separate Cl0p campaign against CVE-2026-12569. Do not mix the two issues. No public source reviewed for this advisory reports exploitation of CVE-2026-126325, and CVE-2026-126325 is not in the CISA Known Exploited Vulnerabilities catalog as of this recheck.
A public PTC Trust Center changelog dated 11 November 2026 at 10:30 AM ET (17:30 Asia/Jerusalem UTC+2) says "A new security patch for the Windchill and FlexPLM critical vulnerability (CVE-2026-126325) is now available," and points to support article CS483249 for download and install instructions. PTC says the patch "should be applied by a Windchill administrator." Official wording on that same update: "If your Windchill or FlexPLM environment is hosted by PTC, the patches have been applied on their behalf. No action is required on your part." "If your Windchill or FlexPLM environment is not hosted by PTC, we urge you to apply the patch as soon as possible to help protect your systems." The detailed article is permissions-required and was not publicly readable in this review; this advisory does not invent patched build numbers.
Organizations that run on-premises Windchill or FlexPLM should confirm whether they are on an affected version and apply the official patch now.
Technical Information
The CVE.org record is PUBLISHED by PTC as CNA. It was published on 11 November 2026 at 15:02:56.037Z (17:02:56 Asia/Jerusalem UTC+2). The official title is "Critical Remote Code Execution (RCE) vulnerability reported in Windchill." The description covers both products: "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data."
The CNA assigns CWE-20 (Improper input validation) and CWE-502 (Deserialization of untrusted data). Both official scores use Attack Complexity High, Privileges Required None, and User Interaction None. The CNA lists discovery as UNKNOWN and does not describe a public exploit.
The vendor-advisory reference on the CVE record is CS483249, titled "Remote Code Execution (RCE) vulnerability (CVE-2026-126325) reported in Windchill PDMLink and FlexPLM," with tags vendor-advisory, mitigation, and permissions-required. The affected product names in the CNA record are Windchill and FlexPLM; this advisory follows those names and the exact version lists below.
The Hacker News (12 November 2026) reports the CNA description, the CVSS 4.0 score of 9.2, and the CNA version lists, and quotes the Trust Center hosted-versus-on-premises wording. THN also carries general commentary from watchTowr on PTC software as a ransomware and initial-access target. That commentary, and the earlier Cl0p campaign against CVE-2026-12569, are not evidence that CVE-2026-126325 is being exploited. This advisory does not claim exploitation of CVE-2026-126325.
CVE-2026-126325 is not in the CISA Known Exploited Vulnerabilities catalog (JSON feed; catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29.8375Z, checked 12 November 2026 at 19:02 Asia/Jerusalem UTC+2).
Affected Product Versions
The lists below are copied from the CNA record. This advisory does not add or drop versions. The CNA marks these versions as affected and sets defaultStatus to unaffected for versions not listed. FlexPLM's list does not include 13.1.4.0; Windchill's list does.
| Product | Affected versions (CNA) | Official fix |
|---|---|---|
| PTC Windchill | 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0, 13.1.4.0 | A vendor patch is available, per PTC's 11 November Trust Center update. Download and install instructions are in CS483249 (permissions-required). This review could not read public patched build numbers. |
| PTC FlexPLM | 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0 | Same official patch path as above, via CS483249. PTC says environments hosted by PTC have already had the patches applied. |
NVD's Received record republishes the same CNA version lists. It does not add a separate official range.
Workaround and Mitigation
If PTC hosts your Windchill or FlexPLM environment, PTC's 11 November Trust Center update says the patches have already been applied on your behalf and no action is required. Confirm that status with PTC if you need operational assurance.
If the environment is not hosted by PTC, apply the official CVE-2026-126325 patch as soon as possible, following CS483249. PTC says a Windchill administrator should apply it. Because the article is login-walled, use your eSupport access (or PTC support) for the exact package and install steps. Do not install unofficial patches or third-party fix scripts.
This review found no public, official workaround that substitutes for the patch, and it does not invent one. As Rescana interim guidance, not a PTC workaround: until the official patch is installed on an on-premises system, reduce internet exposure of Windchill and FlexPLM management interfaces where operations allow, through your normal change process. After patching, verify the installed version and review related admin and service accounts.
Indicators of Compromise
PTC has not published IP addresses, domains, file hashes, or detection signatures for CVE-2026-126325 in the public 11 November Trust Center update or in the CNA record reviewed. There is no basis to invent them.
Indicators published earlier on the same Trust Center page relate to the separate CVE-2026-12569 campaign and are not treated here as evidence of this CVE. Scanning, probing, or activity tied to that earlier campaign is not confirmation that CVE-2026-126325 has been exploited.
What to Ask Your Suppliers Today
Suppliers may run Windchill or FlexPLM to manage product and sourcing data. Ask any supplier that does, or its supporting IT provider:
- Do you run PTC Windchill or FlexPLM, and is it hosted by PTC or on-premises? If PTC hosts it, ask them to confirm the vendor has already applied the CVE-2026-126325 patches, as the 11 November Trust Center update states.
- If on-premises, are you on an affected version? Use the CNA lists above. Ask for the installed product and version, and whether CS483249 has been applied.
- When will you apply the official patch? Require a named owner and a target date. The official direction for environments not hosted by PTC is to apply the patch as soon as possible.
- Are you monitoring for unexpected web shells or unusual administrative activity on the Windchill or FlexPLM hosts? Log review is a defensive check, not evidence that this CVE is being exploited.
Track incomplete answers to closure. These are qualitative TPRM follow-ups, not an internet-scale prevalence claim.
Need help identifying suppliers that run on-premises PTC Windchill or FlexPLM, and tracking whether they have applied the official CVE-2026-126325 patch? Our team can help you prioritize them. Talk to an expert
Sources
- CVE.org record for CVE-2026-126325 — PTC CNA JSON also fetched from cveawg.mitre.org. Published 11 November 2026, 15:02:56.037Z (17:02:56 Asia/Jerusalem UTC+2).
- NVD record for CVE-2026-126325 — vulnStatus Received; published 2026-11-11T15:17:22.510Z (17:17:22 Asia/Jerusalem UTC+2); CNA scores listed as Secondary; no NVD Primary score at this recheck.
- PTC Trust Center: Windchill and FlexPLM RCE advisory — public 11 November 2026, 10:30 AM ET changelog for CVE-2026-126325 (patch available; hosted already patched; on-premises apply as soon as possible). The page also contains earlier, separate entries for CVE-2026-12569 and other Windchill issues; those are not this CVE.
- PTC eSupport CS483249 — official vendor advisory named on the CNA record; permissions-required / SSO-walled in this review (no public article body).
- The Hacker News (12 Nov) — CNA facts and the Trust Center hosted-versus-on-premises wording; watchTowr commentary is general and is not treated as exploitation of this CVE.
- Rescana: earlier Cl0p / CVE-2026-12569 post — a distinct older advisory; not updated by this post; it does not cover CVE-2026-126325.
- CVE-2026-126325 is not in the CISA KEV (JSON feed; catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29.8375Z, checked 12 November 2026 at 19:02 Asia/Jerusalem UTC+2).
