Deserialization in Ptc Flexplm

CVE-2026-77645

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Affected products

Ptc Flexplm — versions 11.0 M030, 11.1 M020, 11.2.1.0
Ptc Windchill Pdmlink — versions 11.0 M030, 11.1 M020, 11.2.1.0

Weakness classification (CWE)

References

0b655efc-079c-4cb9-9e8d-164871239f4e (vendor-advisory, permissions-required, mitigation)