Security AlertCritical
PTC patches Windchill and FlexPLM flaw tied to remote code execution
Nov 12, 2026 · Summarized by Fundy Tech from The Hacker News
The 30-second version
PTC released a patch for CVE-2026-126325, a critical flaw in Windchill and FlexPLM. Hosted customers do not need to act, but on-premises users should patch as soon as possible.
Key points
- CVE-2026-126325 has a CVSS v4 score of 9.2.
- The flaw can lead to remote code execution through crafted requests.
- PTC says hosted environments were patched on customers’ behalf.
Why it matters
If your business uses Windchill or FlexPLM, this could affect product data and operations. Patching reduces the chance of code execution, web shells, and follow-on attacks. For manufacturing and industrial users, that can help avoid downtime and data loss.
Who’s affected: Windchill and FlexPLM users
What to do
- Apply the patch if your system is not hosted by PTC.
- Monitor for web shells or signs of code execution.
- Add network restrictions if you cannot patch right away.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.