---
title: PTC patches a new critical Windchill and FlexPLM deserialization RCE (CVE-2026-126325), five months after Cl0p exploited the last one | ctxsec
url: https://ctxsec.com/items/ptc-windchill-flexplm-cve-2026-126325-deserialization-rce-patch-cs483249
description: "PTC released a patch for CVE-2026-126325, an unauthenticated remote code execution flaw via deserialization of untrusted data in Windchill (11.0 M030 through 13.1.4.0) and FlexPLM (11.0 M030 through 13.1.3.0), rated CVSS 4.0 9.2 / 3.1 9.0 (high attack complexity). PTC-hosted environments have been patched; everyone else should apply the patch from eSupport article CS483249 now. PTC hasn't reported exploitation, but the previous Windchill RCE, CVE-2026-12569, was exploited from June and used by Cl0p-linked actors for data theft."
status: "official (PTC Trust Center update Nov 11, 2026, 10:30 AM ET; CVE record); CVSS 4.0 9.2; PTC hasn't said it is exploited"
published: 2026-11-12
---

> PTC released a patch for CVE-2026-126325, an unauthenticated remote code execution flaw via deserialization of untrusted data in Windchill (11.0 M030 through 13.1.4.0) and FlexPLM (11.0 M030 through 13.1.3.0), rated CVSS 4.0 9.2 / 3.1 9.0 (high attack complexity). PTC-hosted environments have been patched; everyone else should apply the patch from eSupport article CS483249 now. PTC hasn't reported exploitation, but the previous Windchill RCE, CVE-2026-12569, was exploited from June and used by Cl0p-linked actors for data theft.

[← Cybersecurity News](/news) · [markdown](/items/ptc-windchill-flexplm-cve-2026-126325-deserialization-rce-patch-cs483249.md)

official (PTC Trust Center update Nov 11, 2026, 10:30 AM ET; CVE record); CVSS 4.0 9.2; PTC hasn't said it is exploited

2026-11-12 7:40 AM ET

### PTC patches a new critical Windchill and FlexPLM deserialization RCE (CVE-2026-126325), five months after Cl0p exploited the last one

- **Do now:** a Windchill administrator applies CS483249; keep Windchill/FlexPLM off the internet or behind VPN.
- **Check anyway:** reuse the CVE-2026-12569 hunting PTC published: POSTs to new JSP files under `/Windchill/login/` (16 or 6 hex-character names, `dpr_` prefixes, `?cmd=whoami`/`id`) and unexpected child processes of the Windchill service.
- PLM servers hold CAD models and product IP, which is what the June-July extortion campaign took.

Sources: [PTC Trust Center: Remote Code Execution Vulnerability in Windchill and FlexPLM (update Nov 11, 2026, 10:30 AM ET)](https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability) · [CVE-2026-126325 record (OpenAdvisories mirror of the PTC CNA entry)](https://www.openadvisories.org/vuln/CVE-2026-126325) · [The Hacker News: PTC Patches Critical Windchill and FlexPLM Flaw (Nov 12, 2026)](https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html)