Windchill: Improper Input Validation (CVE-2026-77645)

Description

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

Metrics

Weakness classes (CWE)

• CWE-20Class

  Improper Input Validation

  The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

  cwe.mitre.org →

• CWE-502Base

  Deserialization of Untrusted Data

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  cwe.mitre.org →

References & sources

• https://www.ptc.com/en/support/article/CS474826
  vendor-advisorymitigationpermissions-required
• https://www.ptc.com/en/support/article/CS474818
  vendor-advisorypermissions-required

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. CVE Modified2026-08-22 04:18 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
   • SSVC: {"id":"CVE-2026-77645","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI… → {"id":"CVE-2026-77645","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
2. CVE Modified2026-08-21 15:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
   • SSVC: {"id":"CVE-2026-77645","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…

Linked CVEs

• CVE-2026-77646

  A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM.

  high
• CVE-2026-77645

  A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM.

  critical
• CVE-2026-77644

  A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition.

  critical