// AI threat desk · 15 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalRCECVSS 10.0 / 9.3 / 9.2

PTC Windchill and FlexPLM flaw could enable remote code execution

PTC released patches for critical CVE-2026-126325 in Windchill and FlexPLM, which could let unauthorized users execute code remotely.

· 2 min read
AI-generated image of an analyst reviewing blurred vulnerability alerts on laptops and monitors in a security operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • CVE-2026-126325 is a critical vulnerability in PTC Windchill and FlexPLM that could allow remote code execution by an unauthorized user.
  • PTC has released a security patch for the vulnerability.
  • PTC says patches were applied for hosted customer environments, while administrators of non-PTC-hosted environments should apply them as soon as possible.

PTC released patches for CVE-2026-126325, a critical vulnerability in Windchill and FlexPLM that could allow an unauthorized user to execute code remotely.

PTC said patches have been applied for customers whose environments it hosts, while administrators of environments not hosted by PTC are urged to apply the patch as soon as possible.

Windchill is a family of product lifecycle management software products offered by PTC. The disclosure follows an earlier Windchill and FlexPLM remote code execution issue, CVE-2026-12569, that came under active exploitation nearly five months earlier, according to The Hacker News.

On this page

Crafted requests can reach remote code execution

The Hacker News said the flaw involves improper input validation and deserialization of untrusted data through crafted requests. CVE.org described it as a critical remote code execution vulnerability and said it may be exploited through deserialization of untrusted data.

The Hacker News said affected Windchill releases include 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0 and 13.1.4.0. Affected FlexPLM releases include 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0 and 13.1.3.0.

PTC lists indicators linked to Windchill web shells

PTC lists 5.180.41.35 as an attacker command-and-control IPv4 address and says to block it at the perimeter. It also says attackers name web shells with 16 lowercase hexadecimal characters and may deploy new shells with different names.

PTC said legitimate Windchill traffic does not send POST requests to the login JSP path. It urged customers to scan for the newly listed indicators and previously documented indicators, and recommended restricting internet exposure of the Windchill login endpoint where operationally possible.

The earlier Windchill flaw was used in a data extortion campaign

The Hacker News said threat actors linked to the Cl0p ransomware operation were reported in July 2026 to be weaponizing CVE-2026-12569 in a data extortion campaign. The campaign was described as involving JSP web shells and the exfiltration of sensitive product data from manufacturing companies and industrial enterprises.

PTC said important security patches are available for Windchill and FlexPLM versions covered by its SUPs and CPSXB stand-alone patches.

The Hacker News recommended that organizations running the products patch exposed systems and monitor for code execution, backdoor access or web shells on hosts.

What to do now

  1. Apply the patch to non-PTC-hosted Windchill or FlexPLM environments as soon as possible.
  2. Scan environments for the new indicators of compromise listed by PTC and the existing documented indicators.
  3. Restrict internet exposure of the Windchill login endpoint where operationally possible.
  4. Patch exposed systems and monitor for signs of code execution, backdoor access or web shells on the host.

FAQ

What is CVE-2026-126325?

CVE.org described CVE-2026-126325 as a critical remote code execution vulnerability in PTC Windchill and PTC FlexPLM. PTC said an unauthorized user could execute code remotely.

Which Windchill and FlexPLM versions are affected?

The affected Windchill versions listed by The Hacker News include 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0 and 13.1.4.0. The listed FlexPLM versions include 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0 and 13.1.3.0.

How do I fix CVE-2026-126325?

PTC said a security patch is available. Administrators of non-PTC-hosted environments should apply it as soon as possible, while PTC said it applied the patches for hosted customer environments.

How can organizations check for signs of compromise?

PTC says to scan for its newly listed and existing indicators, including the IPv4 address 5.180.41.35 and POST requests to the Windchill login JSP path.

What happened with the earlier Windchill flaw CVE-2026-12569?

The Hacker News said the earlier Windchill and FlexPLM remote code execution issue came under active exploitation nearly five months earlier. It said threat actors linked to the Cl0p ransomware operation were reported in July 2026 to be weaponizing it in a data extortion campaign.

Sources

  1. Customer & Partner Updates: Remote Code Execution Vulnerability in PTC’s Windchill and FlexPLM Solutions | June 2026 | PTC, PTCPrimary
  2. PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution, The Hacker News
  3. Windchill (software), Wikipedia
How we checked this story
ClaimSourceStatus
The Hacker News said pTC released patches for a new critical vulnerability affecting Windchill and FlexPLM software.The Hacker NewsAttributed
The Hacker News said the vulnerability could result in remote code execution if successfully exploited.The Hacker NewsAttributed
The Hacker News said the vulnerability is tracked as CVE-2026-126325 and has a CVSS v4 score of 9.2 out of 10.0.The Hacker NewsAttributed
The Hacker News said the flaw involves improper input validation and deserialization of untrusted data through crafted requests.The Hacker NewsAttributed
CVE.org said the CVE record describes the issue as a critical remote code execution vulnerability in PTC Windchill and PTC FlexPLM.CVE.org, via The Hacker NewsAttributed
CVE.org said the vulnerability may be exploited through deserialization of untrusted data.CVE.org, via The Hacker NewsAttributed
The Hacker News said the affected Windchill versions include 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0, and 13.1.4.0.The Hacker NewsAttributed
The Hacker News said the affected FlexPLM versions include 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, and 13.1.3.0.The Hacker NewsAttributed
PTC identifies the vulnerability as critical in Windchill and FlexPLM and says it requires immediate action.PTCConfirmed
PTC says the vulnerability could allow an unauthorized user to execute code remotely.PTCConfirmed
PTC says a security patch for CVE-2026-126325 is available.PTCConfirmed
PTC says patches have been applied on behalf of customers whose environments it hosts, requiring no customer action.PTCConfirmed
PTC says attackers name web shells with 16 lowercase hexadecimal characters and may deploy new shells with different names.PTCConfirmed
PTC says customers should search logs for POST requests to the Windchill login JSP path.PTCConfirmed
PTC says important security patches are available for listed Windchill and FlexPLM versions.PTCConfirmed
Windchill is a family of product lifecycle management software products offered by PTC.WikipediaConfirmed
PTC products were being used by over 1.1 million users worldwide as of 2011.WikipediaConfirmed
The Hacker News said a previous critical Windchill and FlexPLM remote code execution issue, CVE-2026-12569, came under active exploitation nearly five months earlier.The Hacker NewsAttributed
The Hacker News said threat actors linked to Cl0p were reported in July 2026 to be weaponizing the earlier flaw in a data extortion campaign.The Hacker NewsAttributed

Could not verify

  • Whether CVE-2026-126325 has been exploited in the wild is not established.
  • How many Windchill or FlexPLM installations are affected is not established.
  • Whether the current vulnerability is linked to the earlier Cl0p activity is not established.
  • Whether any customers were compromised by CVE-2026-126325 is not established.
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok