CVE-2026-4681

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 0.72%
EPSS Percentile: 54.04%
CISA KEV: Not listed

Description

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: 0b655efc-079c-4cb9-9e8d-164871239f4e
Published: 24-Mar-2026 05:16
Last Modified: 17-Jun-2026 17:57
EPSS Date: 2026-11-05
CWE: CWE-94

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:L /
                            SI:L /
                            SA:L /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:Y /
                            R:U /
                            V:C /
                            RE:M /
                            U:Red

CNA Products / Version Status

PTC · FlexPLM Source: CNA · 0b655efc-079c-4cb9-9e8d-164871239f4e
Default status: unknown

11.0 M030 — affected
11.1 M020 — affected
11.2.1.0 — affected
12.0.0.0 — affected
12.0.2.0 — affected
12.0.3.0 — affected
12.1.2.0 — affected
12.1.3.0 — affected
13.0.2.0 — affected
13.0.3.0 — affected
PTC · Windchill PDMLink Source: CNA · 0b655efc-079c-4cb9-9e8d-164871239f4e
Default status: unknown

11.0 M030 — affected (semver)
11.1 M020 — affected (semver)
11.2.1.0 — affected (semver)
12.0.2.0 — affected (semver)
12.1.2.0 — affected (semver)
13.0.2.0 — affected (semver)
13.1.0.0 — affected
13.1.1.0 — affected
13.1.2.0 — affected
13.1.3.0 — affected

References

0b655efc-079c-4cb9-9e8d-164871239f4e

Last enrichment sync: 06-Nov-2026 21:04
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2026-4681 — PTC Windchill PDMLink (Critical) Cyble Weekly Report Tracks 1,960 Vulnerabilities, Including PoC Exploits and Critical ICS Flaws

CVE (8)

MITRE ATT&CK (5)

Vendors (5)

Products (10)

Industries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.