PTC: PTC Warns of Critical Windchill, FlexPLM Flaw Enabling Remote Code Execution

Critical RCE Vulnerability in PTC Windchill and FlexPLM Exposes Systems to Attack

PTC has issued an urgent advisory warning of a severe Remote Code Execution (RCE) vulnerability (CVE-2026-4681) affecting its Windchill PDMLink and FlexPLM platforms. The flaw, classified as a code injection vulnerability (CWE-94), carries a CVSS v3.1 score of 10.0 and a CVSS v4 score of 9.3, indicating maximum severity.

Affected Versions

The vulnerability impacts multiple releases, including:

Windchill PDMLink: Versions 11.0 M030 through 13.1.3.0
FlexPLM: Versions 11.0 M030 through 13.0.3.0
All CPS versions prior to 11.0 M030 are also vulnerable.

PTC has confirmed no evidence of active exploitation but warns that the flaw poses a critical risk, particularly for publicly accessible instances.

Exploitation Mechanism

The vulnerability stems from improper handling of deserialized, untrusted data, allowing attackers to execute arbitrary code and potentially gain full system control. While internet-exposed deployments are at highest risk, PTC advises applying mitigations to all installations.

Mitigation Steps

Until official patches are released, PTC recommends the following workarounds:

Apache HTTP Server

Create a configuration file (90-app-Windchill-Auth.conf) in <APACHE_HOME>/conf/conf.d/ with the directive:

<LocationMatch “^.*servlet/(WindchillGW|WindchillAuthGW)/com.ptc.wvs.server.publish.Publish(?:;[^/]*)?/.*$”>
Require all denied

Ensure the file loads last and restart Apache.

Microsoft IIS

Verify the URL Rewrite module is installed.
Modify web.config to include the rewrite rule as the first tag under <system.webServer>.
Restart IIS via iisreset and confirm the rule is active.

PTC notes that File Server or Replica Server configurations may require adjusted steps, and older releases could need additional modifications.

For organizations unable to implement mitigations immediately, PTC suggests shutting down services or disconnecting systems from the internet.

Indicators of Compromise (IOCs)

Security teams should monitor for:

Network patterns:
- Suspicious User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
- Malicious HTTP requests: run?p= .jsp?p=, run?c= .jsp?c=
File system artifacts:
- GW.class or payload.bin (SHA256: C818011CAFF82272F8CC50B670304748984350485383EBAD5206D507A4B44FF1)
- dpr_<8-hex-digits>.jsp or other suspicious .class files (e.g., Gen.class, HTTPRequest.class).
Log anomalies:
- Messages containing GW_READY_OK, ClassNotFoundException for GW Windchill, or HTTP Gateway Exception.

PTC has deployed the Apache workaround for all cloud-hosted customers and is providing 24×7 support for affected users. Organizations detecting IOCs are urged to initiate incident response protocols.

Source: https://thecyberexpress.com/flexplm-vulnerability-cve-2026-4681/

PTC cybersecurity rating report: https://www.rankiteo.com/company/ptcinc

"id": "PTC1774441546",
"linkid": "ptcinc",
"type": "Vulnerability",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Product Lifecycle Management (PLM)',
                        'name': 'PTC Windchill PDMLink',
                        'type': 'Software'},
                       {'industry': 'Product Lifecycle Management (PLM)',
                        'name': 'PTC FlexPLM',
                        'type': 'Software'}],
 'attack_vector': 'Improper handling of deserialized, untrusted data',
 'customer_advisories': 'Organizations detecting IOCs are urged to initiate '
                        'incident response protocols.',
 'description': 'PTC has issued an urgent advisory warning of a severe Remote '
                'Code Execution (RCE) vulnerability (CVE-2026-4681) affecting '
                'its Windchill PDMLink and FlexPLM platforms. The flaw, '
                'classified as a code injection vulnerability (CWE-94), allows '
                'attackers to execute arbitrary code and potentially gain full '
                'system control. The vulnerability impacts multiple versions '
                'and poses a critical risk, particularly for publicly '
                'accessible instances.',
 'impact': {'operational_impact': 'High risk for publicly accessible instances',
            'systems_affected': 'Potential full system control'},
 'investigation_status': 'Ongoing (no evidence of active exploitation yet)',
 'post_incident_analysis': {'corrective_actions': 'Apply mitigations and await '
                                                  'official patches',
                            'root_causes': 'Improper handling of deserialized, '
                                           'untrusted data'},
 'recommendations': ['Apply Apache HTTP Server or Microsoft IIS workarounds '
                     'immediately',
                     'Monitor for IOCs',
                     'Shut down services or disconnect from the internet if '
                     'mitigations cannot be applied',
                     'Prepare for official patch deployment'],
 'references': [{'source': 'PTC Advisory'}],
 'response': {'communication_strategy': 'PTC advisory and 24×7 support for '
                                        'affected users',
              'containment_measures': ['Apache HTTP Server configuration '
                                       'workaround',
                                       'Microsoft IIS URL Rewrite module '
                                       'workaround',
                                       'Shutting down services or '
                                       'disconnecting systems from the '
                                       'internet'],
              'enhanced_monitoring': 'Monitoring for Indicators of Compromise '
                                     '(IOCs)',
              'remediation_measures': 'Apply official patches (pending '
                                      'release)'},
 'stakeholder_advisories': 'PTC has deployed the Apache workaround for all '
                           'cloud-hosted customers and is providing 24×7 '
                           'support.',
 'title': 'Critical RCE Vulnerability in PTC Windchill and FlexPLM Exposes '
          'Systems to Attack',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-4681 (CWE-94)'}