{"id":"EUVD-2026-123544","enisaUuid":"6d487081-c86b-3f11-b4ac-36a2967a3f3d","description":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.","datePublished":"Nov 11, 2026, 3:02:56 PM","dateUpdated":"Nov 11, 2026, 3:02:56 PM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/RE:M/U:Amber","references":"https://www.ptc.com/en/support/article/CS483249\n","aliases":"CVE-2026-126325\nGHSA-5936-vj68-74r3\n","assigner":"PTC","epss":0.51,"enisaIdProduct":[{"id":"1d6c95d6-444e-3785-83fd-a6b816407233","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"12.1.2.0"},{"id":"330af18a-b31a-346c-8476-b5ca7f8ddc88","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"13.1.1.0"},{"id":"49252762-51f5-3a45-a6c9-54ba755f8e23","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"11.0 M030"},{"id":"4b510806-bd4e-330a-9c2f-fe8d0f9de658","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"12.0.2.0"},{"id":"5794a5f7-4afd-35ae-9737-f58412d94b39","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"11.1 M020"},{"id":"690c4160-043a-363a-84a5-a77a616c78d1","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"11.0 M030"},{"id":"6d8eb615-7824-359d-affb-80f58910b6e5","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"13.1.1.0"},{"id":"777c9155-f7a7-30e4-8323-faee5310009c","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"13.1.4.0"},{"id":"98f06e64-ba6c-33f9-951d-5b9e742fd445","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"13.1.3.0"},{"id":"a58bbde0-2d76-3ab0-8408-db98cc72b612","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"13.1.0.0"},{"id":"aec23961-2fb4-320f-8f18-88e606627960","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"11.1 M020"},{"id":"b365ea61-abea-3a33-926b-63be4f8e6365","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"12.0.2.0"},{"id":"b5754003-a20e-366e-9ec5-0638682b13f6","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"13.0.2.0"},{"id":"cdbbdfa9-1882-3d09-87e5-95936a998b89","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"13.1.0.0"},{"id":"e8166962-d36c-3d77-8142-2b560f4a9bb3","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"13.0.2.0"},{"id":"e97949aa-ecb4-3a7f-b771-fa3782441752","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"12.1.2.0"},{"id":"ed3564ef-7ad1-34d0-924a-a106a4ca7cd2","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"11.2.1.0"},{"id":"eddc838f-81c5-3b5d-b271-68d6c43b3ed8","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"13.1.3.0"},{"id":"f1ed2940-e2bc-3bfe-98e7-3cfb57963b84","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"11.2.1.0"},{"id":"fc9ee495-3ce3-351a-bebe-decd8be8d2a2","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"13.1.2.0"},{"id":"fe36991a-ab5c-38cb-bd98-61cc63497908","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"13.1.2.0"}],"enisaIdVendor":[{"id":"e780130b-db06-3856-9bfc-7534f3c2726d","vendor":{"name":"PTC"}}],"enisaIdVulnerability":[{"id":"0aa87b28-748f-3a2c-8704-a1974254265f","vulnerability":{"id":"CVE-2026-126325","description":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.","datePublished":"Nov 11, 2026, 3:02:56 PM","dateUpdated":"Nov 11, 2026, 3:02:56 PM","status":"PUBLISHED","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/RE:M/U:Amber","references":"https://www.ptc.com/en/support/article/CS483249\n","enisa_id":"EUVD-2026-123544\n","assigner":"PTC","epss":0.51,"dataProcessed":"Nov 14, 2026, 7:18:23 AM","vulnerabilityProduct":[{"id":"176e49e7-966e-36bb-92c3-d129cfe3836f","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"12.1.2.0"},{"id":"214538f4-fb8b-3e36-ad65-fcf66af03855","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"12.0.2.0"},{"id":"236a1e50-c7d8-3e6b-ba8c-04538217ac78","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"13.1.0.0"},{"id":"3633ca35-1993-3af7-a514-9b707e607020","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"11.1 M020"},{"id":"4f3fe65c-fe79-31c9-87bf-3cb96464a1ba","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"11.2.1.0"},{"id":"601be0eb-05ce-31b2-834e-f2994029fb00","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"11.0 M030"},{"id":"64212cf4-b158-3f5a-a13c-e378a0cd32e8","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"12.1.2.0"},{"id":"67ee6fda-3200-3104-944e-c3a7b93d7acf","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"13.1.1.0"},{"id":"68eacb78-1212-32ac-9a8b-d459cff5897d","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"12.0.2.0"},{"id":"703df494-fc64-39dc-a372-575f2f532dee","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"13.1.0.0"},{"id":"7b11fb39-e208-3402-a7ce-ae3743b701e8","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"11.1 M020"},{"id":"7e01a1b4-c447-3ed4-87a5-c8e38fdf194d","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"13.1.3.0"},{"id":"a89c764d-40bb-3192-ab42-f8de557ba25f","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"11.2.1.0"},{"id":"b9f1ae51-904f-328e-801e-311fd3448f98","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"13.1.4.0"},{"id":"bbd47a4c-c036-3b02-9618-1c2b61f75112","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"11.0 M030"},{"id":"e1265e18-2131-3823-a12e-2df6608466cd","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"13.0.2.0"},{"id":"eaeb8385-28e8-395d-b882-94aecdcf18cb","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"13.1.2.0"},{"id":"ec0b7c31-ef78-332f-965c-c821ed89d567","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"13.1.1.0"},{"id":"eeb07903-13ee-32ea-8783-0ae1d0cf7663","product":{"name":"FlexPLM","vendor":{"name":"PTC"}},"product_version":"13.1.3.0"},{"id":"f2f8eb30-c0f8-3f68-94fd-0224875f0e2e","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"13.0.2.0"},{"id":"f39cb1d6-edca-3dbf-9aef-dae348de4b01","product":{"name":"Windchill","vendor":{"name":"PTC"}},"product_version":"13.1.2.0"}],"vulnerabilityVendor":[{"id":"ee49a695-8607-3854-84b1-3f1c63f5f3cb","vendor":{"name":"PTC"}}]}},{"id":"f3705bad-b77a-316a-b3f1-a9a4b7c375ba","vulnerability":{"id":"GHSA-5936-vj68-74r3","description":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.","datePublished":"Nov 11, 2026, 3:31:05 PM","dateUpdated":"Nov 11, 2026, 3:31:05 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-126325\nhttps://www.ptc.com/en/support/article/CS483249\n","enisa_id":"EUVD-2026-123544\n","aliases":"CVE-2026-126325\nGHSA-5936-vj68-74r3\n","epss":0.0,"dataProcessed":"Nov 14, 2026, 7:06:15 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"16f277ca-8a15-320f-acd0-d32dc7b08b80","advisory":{"id":"WID-SEC-W-2026-4540","description":"PTC FlexPLM: Schwachstelle ermöglicht Codeausführung","summary":"Ein entfernter, anonymer Angreifer kann eine Schwachstelle in PTC FlexPLM und PTC Windchill ausnutzen, um beliebigen Programmcode auszuführen.","datePublished":"Nov 11, 2026, 11:00:00 PM","dateUpdated":"Nov 11, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4540.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-4540\n","aliases":"CVE-2026-126325\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"1082dd30-7951-325a-b656-cc88af265573","product":{"name":"PTC FlexPLM","vendor":{"name":"PTC"}}},{"id":"ae73c90c-bf6c-3d06-8f20-717ee0972d49","product":{"name":"PTC Windchill","vendor":{"name":"PTC"}}}]}}]}