CVE-2026-126325

validating

no check availablenot proven exploitable

cve.orgpublic pockev

PTC Windchill 11.2.1.0; 12.0.2.0; 12.1.2.0; 13.0.2.0; 13.1.0.0; 13.1.1.0; 13.1.2.0; 13.1.3.0; 13.1.4.0; 11.0 M030; 11.1 M020

CWE-20 Improper Input Validation

ETK-2026-4182, permanent identifier

cvss9.2cna vendorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/RE:M/U:Amber

–running

startingcurrent stage

timeline

0 = cve.org publication

trigger signal (cve.org) +0h

+2h

+4h

+6h

+8h

+10h

+12h

description

PTC Windchill and FlexPLM are affected by unsafe handling of untrusted serialized data. An unauthenticated network attacker may be able to execute code if they can reach a vulnerable deserialization path and supply untrusted data.

Still under analysis: more detail becomes available as the pipeline runs.

mitigation

Restrict network access to Windchill and FlexPLM services that may process serialized input, allowing only trusted systems where possible. Block untrusted serialized data and monitor PTC guidance for a supported update.

check

building now

exploit

not yet

automation

–

auth required

EPSS

–

agent run time

cve.org record, t = 0

2026-11-11 15:02Z

Δ to public poc

–

Δ to kev

–

outcome

Run in progress: no artifact yet.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-11 15:02Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-126325

this entry in the feed

GET /api/v1/feed/CVE-2026-126325

{
  "etk_id": "ETK-2026-4182",
  "cve_id": "CVE-2026-126325",
  "display_id": "CVE-2026-126325",
  "ghsa_id": "GHSA-5936-vj68-74r3",
  "euvd_id": null,
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Unsafe deserialization in PTC Windchill and FlexPLM",
  "summary": "PTC Windchill and FlexPLM are affected by unsafe handling of untrusted serialized data. An unauthenticated network attacker may be able to execute code if they can reach a vulnerable deserialization path and supply untrusted data.",
  "mitigation": "Restrict network access to Windchill and FlexPLM services that may process serialized input, allowing only trusted systems where possible. Block untrusted serialized data and monitor PTC guidance for a supported update.",
  "vendor": "PTC",
  "product": "Windchill",
  "affected": [
    {
      "affected_notes": [
        "11.0 M030",
        "11.1 M020"
      ],
      "affected_ranges": [
        "11.2.1.0",
        "12.0.2.0",
        "12.1.2.0",
        "13.0.2.0",
        "13.1.0.0",
        "13.1.1.0",
        "13.1.2.0",
        "13.1.3.0",
        "13.1.4.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Windchill",
      "purl": null
    },
    {
      "affected_notes": [
        "11.0 M030",
        "11.1 M020"
      ],
      "affected_ranges": [
        "11.2.1.0",
        "12.0.2.0",
        "12.1.2.0",
        "13.0.2.0",
        "13.1.0.0",
        "13.1.1.0",
        "13.1.2.0",
        "13.1.3.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "FlexPLM",
      "purl": null
    }
  ],
  "cwes": [
    20
  ],
  "cvss_score": 9.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/RE:M/U:Amber",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.069005366666667,
  "t0_at": "2026-11-11T15:02:56.037000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T15:02:56.037000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T15:02:56.037000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-126325"
    }
  }
}

published 2026-11-11 15:27Z
last change 2026-11-11 15:57Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.