External risk intelligence

PTC Windchill and FlexPLM Untrusted Data Deserialization RCE.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-77645

PTC Windchill and FlexPLM are enterprise platforms typically hosted within internal corporate networks. While they are not intended for public exposure, they are sometimes accessible via the internet to support distributed teams or supply chain partners. Because these systems may be reachable over a network, internet-facing instances can be exposed to remote exploitation.

Deserialization

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been reported in PTC Windchill and PTC FlexPLM, potentially allowing remote code execution through the deserialization of untrusted data. The main concern is confirming relevance and exposure to these enterprise platforms.

Remote code execution risk exists.
Understand potential exposure to core business platforms.
Confirm if these systems are in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to a vulnerable PTC Windchill or FlexPLM system. This could allow the attacker to execute arbitrary code on the affected system, potentially leading to a complete compromise.

No specific access required.
Deserializing untrusted data.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow attackers to execute arbitrary code on affected systems when processing untrusted data. Such an attack could compromise the integrity and availability of the PTC Windchill and PTC FlexPLM services.

System data could be affected.
Untrusted data deserialization can lead to exposure.
Arbitrary code execution is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in PTC Windchill and PTC FlexPLM, stemming from untrusted data deserialization, requires immediate attention from teams responsible for these enterprise applications. The first step is to identify all instances, confirm their exposure and criticality, and then assign ownership for remediation planning.

Assign ownership for the affected platforms.
Verify network reachability and business criticality.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PTC Windchill and FlexPLM?

These are enterprise-grade software platforms used primarily by manufacturing and product development organizations. Windchill acts as a Product Lifecycle Management (PLM) system for managing product data and processes, while FlexPLM is tailored for retail, footwear, and apparel industries to manage product development workflows from design to sourcing.

How does deserialization lead to RCE in CVE-2026-77645?

This vulnerability involves 'Deserialization of Untrusted Data' (CWE-502). When the software reconstructs data objects from an external source, it fails to sufficiently validate that information. An attacker can craft malicious data that, when processed, tricks the application into executing unauthorized commands, resulting in Remote Code Execution (RCE).

Does any specific action trigger this vulnerability?

The flaw is triggered when the system processes specially crafted, untrusted data payloads sent over a network. It does not require a user to log in or interact with the interface to initiate the attack. Simply sending the malicious data to a reachable instance of the software is sufficient to attempt exploitation.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal notes that while these platforms are typically hosted within secure internal networks, they are occasionally exposed to the internet to support remote teams or partners. If your Windchill or FlexPLM instance is reachable via the internet, it faces a significantly higher risk of exploitation compared to those isolated on internal networks.

What should I do first to address CVE-2026-77645?

Begin by creating an inventory of all Windchill and FlexPLM deployments within your organization. Confirm which instances are accessible from the internet versus those strictly on internal networks. Once mapped, identify the teams responsible for these applications and ensure they are prioritizing the review of official vendor security communications for remediation steps.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.