PTC has released patches for a critical vulnerability in its Windchill and FlexPLM software that could let an attacker run code on affected systems. The flaw, tracked as CVE-2026-126325, carries a CVSS v4 score of 9.2 out of 10, and PTC published the patch on 11 November 2026.

Windchill is product lifecycle management software used by manufacturers to manage product designs and data, while FlexPLM serves the same role for retail, footwear and apparel companies. A flaw in software of this kind matters because these systems hold detailed product designs, supplier information and manufacturing plans, and an attacker who gains control of them could disrupt production or steal commercially sensitive data.

What the flaw is

PTC describes the vulnerability as a combination of improper input validation and the deserialisation of untrusted data. In plain terms, the software does not check incoming data carefully enough before processing it, and an attacker can send crafted requests that exploit that weakness to execute their own code on the server. The CVE record lists the weaknesses as CWE-20 and CWE-502, and PTC rates the flaw 9.2 under CVSS version 4 and 9.0 under CVSS version 3.1.

The affected versions are wide-ranging. PTC Windchill versions 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0 and 13.1.4.0 are affected, along with the same range of FlexPLM versions up to 13.1.3.0. Organisations running any of these releases should treat the patch as urgent, particularly if their Windchill or FlexPLM system is reachable from the internet.

Hosted systems already patched

PTC said in its advisory that environments hosted by PTC have already had the patches applied on customers' behalf, so those customers need take no action. Customers running self-hosted Windchill or FlexPLM environments must install the patch themselves, and PTC urges them to do so as soon as possible. The patch instructions are in PTC support article CS483249, and the company says the patch should be applied by a Windchill administrator.

A familiar target for attackers

The disclosure comes about five months after another critical remote code execution flaw in the same software, CVE-2026-12569, came under active exploitation. That earlier flaw, scored 9.3, was exploited by threat actors linked to the Cl0p ransomware operation in July 2026, who used it to deploy web shells and steal data from affected systems. The history makes the new flaw a priority: attackers have already shown they watch Windchill closely and move quickly when a serious weakness appears.

There is no confirmed report of CVE-2026-126325 being exploited so far, and the flaw is not listed in the US CISA Known Exploited Vulnerabilities catalogue. That is no reason to delay, however. The patch is available now, the affected software is a proven target, and the window between disclosure and exploitation has been short in the past. Manufacturers and retailers running self-hosted Windchill or FlexPLM should apply the update, check that internet-facing systems are not unnecessarily exposed, and review logs for unusual activity around their product-data servers.

Sources: The Hacker News, PTC