PTC Windchill & FlexPLM CVE-2026-126325: Critical Deserialization RCE

PTC has shipped patches for a new critical remote code execution flaw in Windchill and FlexPLM — the product lifecycle management (PLM) systems that hold the CAD models, bills of materials and regulated engineering data of aerospace, automotive, defense and medical-device manufacturers. CVE-2026-126325 is a deserialization of untrusted data that can lead to code execution on the application server, scored CVSS 9.2 by PTC. There is no confirmed exploitation in the wild yet, and it is not in CISA's KEV catalog. That is the window, not the all-clear: in June 2026 the previous deserialization bug in the exact same products, CVE-2026-12569, went from advisory to CISA KEV with a three-day federal deadline in eight days, with attackers dropping web shells on internet-facing instances. The clock on this one has already started.

Developing story — first published 14:10 CET (13:10 UTC), November 12, 2026. Updated as PTC and CISA publish more.

At a glance

CVE	CVE-2026-126325
Product / affected versions	PTC Windchill 11.0 M030 · 11.1 M020 · 11.2.1.0 · 12.0.2.0 · 12.1.2.0 · 13.0.2.0 · 13.1.0.0 through 13.1.4.0; PTC FlexPLM the same releases through 13.1.3.0 (per NVD)
Fixed in	Patched — see PTC Support article CS483249 for the per-branch fixed builds; PTC-hosted (cloud) environments already updated, customer-hosted must patch themselves
CVSS	9.2 Critical · CVSS 4.0 · scored by PTC (CNA) · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H (Automatable: Yes); also 9.0 Critical · CVSS 3.1 · Scope Changed
Exploited in the wild	No evidence on record as of 2026-11-12 (OffSeq threat radar; no source reports exploitation)
CISA KEV	Not listed (catalog version 2026.11.10)
Public PoC	None public as of 2026-11-12
Official advisory	PTC Support article CS483249 (ptc.com)

What CVE-2026-126325 actually is

The weakness is improper input validation (CWE-20) and deserialization of untrusted data (CWE-502). In plain terms: the application accepts a serialized object from the network and reconstructs it without validating what it is first. In enterprise Java — and Windchill is a large Java application — that is the classic path to remote code execution. A deserialization gadget chain turns "rebuild this object" into "run this code," and the attacker never needs a memory-corruption primitive or a credential.

The CVSS 4.0 vector PTC published is worth reading precisely, because it is not the maximal 9.8-style string:

• AV:N / PR:N / UI:N — reachable over the network, no privileges, no user interaction. The attacker sends a request; nobody has to click.
• AC:H — attack complexity is High. There is a condition the attacker does not fully control (a specific gadget, configuration, or timing) that makes reliable exploitation harder than a trivial bug.
• AU:Y (Automatable: Yes) — the reconnaissance, weaponization and exploitation steps can be automated at scale once a working chain exists. High complexity slows the first exploit; it does not slow the hundredth.
• VC:H/VI:H/VA:H and a Changed scope on the 3.1 vector — full compromise of the confidentiality, integrity and availability of the data the PLM server can reach, which in a PLM deployment is the entire engineering record.

"High attack complexity, not yet exploited" is the reason you have a few days instead of a few hours. It is not a reason to deprioritize. Deserialization bugs are reverse-engineered from the patch diff routinely, and AU:Y tells you the vendor expects a weaponized version to scale once it exists.

Are my Windchill or FlexPLM servers exposed?

Per NVD, the affected footprint spans the whole supported range — Windchill and FlexPLM from the 11.0 line through 13.1.x. If you run either product, assume you are affected until you have confirmed a patched build. Two questions decide your priority order:

1. Is the instance internet-reachable? PLM is supposed to live behind the firewall, served to engineers, suppliers and change-management workflows. In practice, supplier portals and remote-engineering access push instances onto the perimeter. An internet-facing Windchill with an unauthenticated network RCE is the first thing to patch tonight — it is exactly the profile that put the June CVE into KEV.
2. What can the application server reach? The blast radius of code execution on a PLM app server is the data it is trusted to serve: CAD geometry, BOMs, engineering change orders, and — for defense and aerospace primes — ITAR/EAR-controlled technical data whose mere exfiltration is a reportable event.

"We patched in June." — The June fix was for CVE-2026-12569. This is a distinct flaw with its own patch. A build that closed the June bug does not close this one; check your version against PTC Support article CS483249 specifically.

Remediation

1. Am I affected?

Identify the exact running build of every Windchill and FlexPLM instance — not the version you think you deployed, the version actually running after the last maintenance window. Inventory internet-facing instances first (check your edge/WAF rules and external attack-surface data for anything answering on the Windchill HTTP(S) ports), then internal ones. Any build in the 11.0–13.1.x range that is not on the CS483249 fixed level is in scope.

2. Patch — the exact fixed versions

Apply the per-branch patched build listed in PTC Support article CS483249. PTC assigns fixed builds per release line (11.x, 12.x, 13.0, 13.1); install the one matching your branch rather than forcing a major upgrade under pressure. PTC-hosted (cloud) environments have already been updated by PTC; customer-hosted and on-premise deployments are the customer's responsibility and are the ones at risk right now. Confirm the build string after the patch and after the service restarts — a server that was never restarted is still running the vulnerable code.

3. Can't patch tonight? Compensating controls

• Pull it off the internet. If a Windchill or FlexPLM instance is internet-reachable, restrict it to the internal network or a VPN/allowlist immediately. This is the single highest-value control and it closes the unauthenticated-network precondition.
• Front it with request filtering. Where exposure cannot be removed, put a WAF/reverse proxy in front and restrict access to the specific application endpoints your users need. This raises the already-High attack complexity further; it does not substitute for the patch.
• Treat compensating controls as a stopgap measured in days, not a fix. Set the patch deadline now.

4. Hunt for compromise

No vendor or researcher IOCs have been published for CVE-2026-126325 yet, so hunt on behavior, not indicators — and do not invent IOCs. Generalizable signals for a Java deserialization RCE on an app server (mapped to MITRE ATT&CK):

• Child processes spawned by the Windchill/application-server service account — shells, cmd.exe/powershell.exe, scripting interpreters, network tools launched by the Java process (T1190 Exploit Public-Facing Application, T1059 Command and Scripting Interpreter).
• New or modified files under the web/app directories — a JSP/servlet web shell is the first thing an operator drops for persistence, exactly as happened in June (T1505.003 Web Shell).
• Anomalous outbound connections from the PLM host to never-seen destinations — a tool pull, a beacon, or the staging and egress of bulk CAD/BOM data (T1041 Exfiltration Over C2 Channel).
• Unusual request patterns to the application endpoints that deserialize input — large or malformed serialized payloads in request bodies.

5. Eradicate and verify

If you find a web shell or implant, removing the file is not enough: rebuild from a known-good image where feasible, rotate every credential and service-account secret the compromised host could read (PLM servers hold integration and database credentials), and invalidate active sessions. Then confirm the fix after patching — re-test that the deserialization endpoint rejects the proof that demonstrated the issue, rather than trusting the version string alone.

What is not known yet

• Exact fixed builds are in PTC's CS483249 article (customer-portal gated); NVD and third-party trackers do not yet list them.
• Exploitation status. As of this writing there is no evidence of in-the-wild exploitation and the CVE is not in CISA KEV — but the June precedent on the same products argues against complacency.
• The gadget chain. PTC has not published technical detail on the deserialization sink or the AC:H precondition, and no public PoC exists yet. Expect patch-diff analysis to narrow this within days.
• CISA SSVC / NVD enrichment. The NVD record is still in "Received" status; a full NVD analysis and any CISA SSVC decision will follow.

Don't guess whether you're exploitable — prove it

The honest answer to "a critical RCE patch dropped, but it's not confirmed exploited — how hard do I run?" is not a version-string lookup. A version string tells you which build is installed; it does not tell you whether your Windchill, in your network, with your configuration and exposure, can actually be reached and driven to code execution. That gap is where organizations either panic-patch everything at once or quietly deprioritize — and both are expensive guesses.

Zero Hunt is an autonomous AI red team that runs on an on-premise appliance on its own private models, with a human in the loop for every action that matters. Against a disclosure like this, its 10-agent swarm identifies the exact installed Windchill/FlexPLM version and, in gray-box mode against your own gear, analyzes that version for the input-reachable deserialization path and iterates a working proof-of-concept — in an ephemeral, hardened container that never touches the appliance host — until it demonstrably reaches the sink or demonstrably cannot. Because the models run locally, pointing the engine at a PLM system that holds ITAR/EAR-controlled designs and integration credentials never ships any of that to a third party. You get a ranked, evidence-backed answer to which specific instances are actually exploitable, so the genuinely-exposed ones get patched first.

Once that is known, the AI Remediation Advisor turns it into a fix plan ordered by real exploitability — CISA KEV status first, then what was proven reachable in your environment, then CVSS and EPSS — with the exact PTC build to install, rollback notes, and the compensating control to hold the line until the maintenance window, then re-verifies the fix with the same proof that demonstrated the issue. It is the difference between automated, continuous penetration testing that keeps pace with disclosures like this one and the annual report that would have told you about the June bug in next year's engagement. For how to triage when the KEV clock is the forcing function, see our note on CISA BOD 26-04 risk-based patching; for the deeper context on why a PLM breach is industrial espionage rather than an IT incident, see our June analysis of CVE-2026-12569.