PTC has released patches for a critical security flaw in its Windchill and FlexPLM software that could allow an attacker to run malicious code on affected systems.

The vulnerability, tracked as CVE-2026-126325, carries a score of 9.2 out of a maximum of 10 under the CVSS version 4 rating system, placing it firmly in the critical range. It stems from improper input validation combined with the deserialization of untrusted data, a weakness that can allow an attacker to send specially crafted requests to a vulnerable server and execute code remotely.

Which versions are affected

The flaw affects a wide range of Windchill releases, from 11.0 M030 and 11.1 M020 through versions 12.0.2.0, 12.1.2.0, 13.0.2.0 and the 13.1 series up to 13.1.4.0. FlexPLM is affected across the same generations, from 11.0 M030 through 13.1.3.0. Organisations running any of these versions on their own infrastructure should treat the update as urgent, because the flaw needs no login credentials to exploit if the system is reachable.

PTC said environments hosted by the company itself have already been patched, so those customers need take no action. For everyone else, the message is direct: apply the patch as soon as possible.

Why this flaw matters for manufacturers

Windchill is product lifecycle management software used by manufacturers to store designs, product data and engineering documents, while FlexPLM serves the same role for retail, footwear and apparel businesses. A successful attack could therefore expose sensitive product data, disrupt production planning or give an intruder a foothold deep inside a company's network.

Security researchers have warned that PTC software is a favoured target for initial access brokers and ransomware groups precisely because it sits at the heart of manufacturing operations, where downtime quickly becomes expensive and stolen designs carry real value.

A warning from the last flaw

The disclosure comes about five months after a similar critical flaw in the same products, CVE-2026-12569, came under active exploitation. That earlier vulnerability, scored 9.3, was weaponised in July 2026 by threat actors linked to the Cl0p ransomware operation, who used it to plant web shells and steal product data from manufacturing and industrial companies as part of a data extortion campaign.

There is no confirmed evidence so far that CVE-2026-126325 is being exploited in the wild. But the history of the previous flaw shows how quickly attackers move against PTC systems once a serious vulnerability becomes public.

What to do now

Organisations running Windchill or FlexPLM should apply the patches immediately and check exposed systems for signs of code execution, backdoor access or web shells. Where patching cannot be done at once, network restrictions should be used to limit which systems can reach the affected servers. PTC's support article CS483249 carries the patch details, and the CVE record lists the affected versions in full.

Sources: The Hacker News, PTC