PTC says deserialization of untrusted data may allow exploitation. The PTC CVE record rates it 9.2 Critical under CVSS 4.0 and 9.0 Critical under CVSS 3.1.The published vectors describe network access without prior privileges or user interaction, but with high attack complexity. Teams should inventory externally reachable installations through their external attack surface management process, then compare each build with PTC's affected list.
What it allows
How Could CVE-2026-126325 Lead to Remote Code Execution?
PTC identifies deserialization of untrusted data and improper input validation as the weakness types. The record says the flaw may be exploited for remote code execution. It does not describe the entry point or a complete exploit path.
The PTC CVSS vectors describe a network reachable attack that needs no account and no user interaction. They also rate attack complexity high. If exploitation succeeds, PTC assigns high confidentiality, integrity, and availability impact to the vulnerable system.
What Does the Exploitation Evidence Establish?
PTC's CVE record describes a possible attack mechanism, not a verified intrusion. The record does not identify a campaign or provide an exploitation date. Operational exploitation status is therefore unknown in this profile.
Brandefense Blackhole counted five dark chat posts mentioning CVE-2026-126325 from August 14 through November 12, 2026. These are posts counted in that source and period, not verified incidents or proof of successful exploitation. Use those mentions as a prompt to review your own exposure and logs.
Who is affected
Which Windchill and FlexPLM Builds Does PTC List?
PTC lists both Windchill and FlexPLM builds 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, and 13.1.3.0 as affected. Its Windchill list also includes 13.1.4.0. The FlexPLM list ends at 13.1.3.0 in the public CVE record.
These are discrete affected entries, not a published fixed-version boundary. Inventory the installed product and exact build, including instances reachable through a gateway or partner connection. Compare each build with PTC's record and ask PTC support for the applicable remediation and any environment-specific conditions.
PTC's linked support article requires access, so this public record does not establish a verified fixed build or deployment date. Record the advisory guidance you receive and verify the installed build after change. Keep that evidence in your patch management process.
Timeline
- 2026-11-11
PTC published the CVE record naming Windchill and FlexPLM, affected builds, and CVSS 4.0 and 3.1 scores.
What to do
-
Inventory and prioritize reachable instances
Identify Windchill and FlexPLM deployments, exact builds, and network exposure. Prioritize internet-facing and partner-accessible systems listed in PTC's affected entries.
-
Obtain PTC remediation guidance
Consult PTC support article CS483249 or your PTC support contact for the applicable update or mitigation. Do not treat an unlisted build as fixed without vendor confirmation.
-
Apply the vendor-supported change and verify the build
Apply the PTC-approved remediation under change control. Afterward, check the running product build against PTC's guidance and record the verification result.
-
Review access and system activity
Review access, application, and system logs around exposed instances for unexpected activity. Correlate any findings through a vulnerability intelligence platform and your incident response process.
What Brandefense can do
- Watch your stack for exploited flaws
Name the vendors and products you run, and Brandefense alerts you when a CVE in them is exploited.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Does CVE-2026-126325 require authentication?
PTC's CVSS 4.0 and 3.1 vectors both assign no privileges required. They describe network access and no user interaction, with high attack complexity.
Which PTC products and versions are affected?
PTC lists ten shared Windchill and FlexPLM builds from 11.0 M030 through 13.1.3.0 as discrete entries. Windchill 13.1.4.0 is also listed.
Is there a verified fixed version for CVE-2026-126325?
The public PTC CVE record lists affected builds but does not specify a fixed build. Obtain remediation guidance from PTC support and verify the running build afterward.
Does the Blackhole count prove exploitation?
No. Brandefense Blackhole counted five dark chat posts mentioning the CVE from August 14 through November 12, 2026. Mentions do not establish an intrusion.
Sources
- CVE-2026-126325 RecordPTC CNA via CVE Program
- Known Exploited Vulnerabilities CatalogCISA
