Intel

CVE-2026-77646

Windchill: Deserialization of Untrusted Data (CVE-2026-77646)

highEPSS 0.4%

Affected

  • PTC/Windchill range_unparsed *..Risk and Reliability (WRR) Enterprise Edition <13.1.0.1
  • PTC/Windchill = PDMLink..PDMLink

Description

A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Source: BSI CSAFBSI WID PortalNVD (NIST)cvelistv5

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

PTCWindchill
PDMLinkRisk and Reliability (WRR) Enterprise Edition <13.1.0.1

Metrics

XIEM Effective CVSS
7.7
Source: cna-v4
EPSS percentile
36.1 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
high
Priority score
75.17
Exploit maturity
no public PoC known
CVSS v4
7.7
EPSS score
0.4 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-20 22:11 UTC
CWE
CWE-502, CWE-918

Weakness classes (CWE)

  • CWE-502Base

    Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

    cwe.mitre.org →

  • CWE-918Base

    Server-Side Request Forgery (SSRF)

    The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

    cwe.mitre.org →

References & sources