CVE-2026-4681

This vulnerability lets an attacker send specially crafted network requests to Windchill/FlexPLM and cause the system to run code it shouldn’t. Think of it like a mailroom that mistakenly opens and follows instructions from an untrusted package—once code runs, an attacker can potentially take over the server and access sensitive business information.

This matters if you use or host PTC Windchill PDMLink or PTC FlexPLM, especially if any part of the system is reachable from the network you don’t fully control. The key risk is that the flaw can be triggered remotely without any login and without user interaction. Treat it as higher risk when the affected service is reachable over the network (for example, from the public internet), and act urgently even before you confirm exact reachability.

This should be treated as urgent (amber) because the flaw is a critical remote code execution issue that can be triggered without authentication. There is no confirmed public exploitation in the findings, but the vendor is recommending immediate configuration mitigations, which typically indicates a serious, high-likelihood exposure path for reachable systems.

1. Confirm exposure

   • Identify the exact product name (Windchill PDMLink or FlexPLM) and the running version/build.
   • Compare your version to the affected list for CVE-2026-4681.

2. Apply the vendor’s immediate mitigations

   • Apply PTC’s recommended Apache HTTP Server workaround/configuration steps for every Windchill or FlexPLM system that uses Apache, following the vendor’s “Apache HTTP Server Configuration – Workaround Steps.”
   • Apply the equivalent HTTP Server mitigation guidance provided by PTC for IIS HTTP Server as referenced in the vendor remediation notes.
   • Apply these changes broadly across deployments, not only those exposed to the public internet, per PTC’s recommendation.

3. Upgrade to the vendor’s fixed state

   • Use the vendor’s official remediation guidance to move to the fixed version(s) or apply the appropriate patches/updates.
   • If multiple environments exist (test, staging, production), prioritize production and any externally reachable instances first, then roll forward.

4. Temporary risk reduction if you cannot patch quickly

   • Reduce who can reach the service: ensure the Windchill/FlexPLM endpoints are not reachable from the public internet until mitigations and upgrades are completed.

5. What to monitor after changes

   • Watch for abnormal inbound requests to Windchill/FlexPLM endpoints around the time of mitigation changes.
   • Verify application and web server logs remain healthy after configuration updates.

6. Timelines

   • The findings do not provide a CISA due date (and KEV is not listed). Follow PTC’s “immediately apply” mitigation guidance first, then complete the full remediation on the fastest realistic schedule.

Severity and type: The reported issue is critical remote code execution (CWE-94) affecting PTC Windchill PDMLink and PTC FlexPLM.

Mechanism: An unauthenticated attacker can trigger remote code execution by causing the application to deserialize untrusted data received via the network. This means attacker-controlled input reaches a deserialization pathway that is not safely handled.

Authentication and interaction: The findings state no authentication is required and no user interaction is needed.

Exploitation status: CISA KEV is not listed for this CVE, and the findings report no confirmed exploitation in press articles; no public exploit code is on record.

Risk outlook: Although the EPSS score is presented as a prediction (and is not a guarantee), the vendor’s remediation notes emphasize immediate configuration/mitigation steps, which is consistent with high exposure risk for reachable deployments.

Attack vector: Network-based reachability is the stated vector; exact “reachable in default configuration” is unknown in the findings, so exposure depends on how your Windchill/FlexPLM web endpoints are exposed in your environment.