Vendor
PTC
44 known vulnerabilities in products by PTC, 1 of them actively exploited (CISA KEV).
Key figures
44
Vulnerabilities
1
Actively exploited (KEV)
1
Used by ransomware
17
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-12569 | Remote Code Execution (RCE) vulnerability in Windchill PDMlink In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2023-0755 | PTC ThingWorx Edge C-SDK: Improper Validation of Array Index | 9.8 | |
| Critical | CVE-2020-27265 | GE Industrial Gateway Server: Stack-based Buffer Overflow | 9.8 | |
| Critical | CVE-2022-25247 | PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function | 9.8 | |
| Critical | CVE-2020-27263 | ThingWorx Kepware Server: Heap-based Buffer Overflow | 9.1 | |
| Critical | CVE-2020-27267 | ThingWorx Kepware Server: Use After Free | 9.1 | |
| Critical | CVE-2022-2825 | Kepware KEPServerEX: Stack-based Buffer Overflow | 9.8 | |
| Critical | CVE-2023-0754 | PTC ThingWorx Edge C-SDK: Integer Overflow or Wraparound | 9.8 | |
| Critical | CVE-2022-2848 | Kepware KEPServerEX: Heap-based Buffer Overflow | 9.1 | |
| Critical | CVE-2022-25251 | PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function | 9.8 | |
| Critical | CVE-2022-25246 | PTC Axeda agent and Axeda Desktop Server Use of Hard-Coded Credentials | 9.8 | |
| High | CVE-2022-25249 | PTC Axeda agent and Axeda Desktop Server Path Traversal | 7.5 | |
| High | CVE-2018-20092 | PTC ThingWorx Platform: Path Traversal | 7.5 | |
| Critical | CVE-2024-6071 | PTC Creo Elements/Direct License Server Missing Authorization | 10.0 | |
| Critical | CVE-2026-77645 | Critical Remote Code Execution (RCE) vulnerability reported in Windchill | — | |
| Critical | CVE-2026-4681 | Critical Remote Code Execution vulnerability reported in Windchill | — | |
| High | CVE-2022-25250 | PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function | 7.5 | |
| High | CVE-2022-25252 | PTC Axeda agent and Axeda Desktop Server Improper Check or Handling Of Exceptional Conditions | 7.5 | |
| Critical | CVE-2026-77644 | PTC Windchill Risk and Reliability (WRR) Enterprise Edition: Missing Authentication for Critical Function | — | |
| Critical | CVE-2023-5908 | Heap Based Buffer Overflow in PTC KEPServerEx | 9.1 | |
| High | CVE-2026-77646 | Server Side Request Forgery (SSRF) vulnerability reported in Windchill | — | |
| High | CVE-2023-4296 | PTC Codebeamer Cross site scripting | 8.8 | |
| Medium | CVE-2018-17216 | PTC ThingWorx Platform: security vulnerability | 6.5 | |
| Not rated | CVE-2015-2061 | PTC Creo View: Heap-Based Buffer Overflow | — | |
| High | CVE-2023-3825 | PTC KEPServerEX: Uncontrolled Resource Consumption | 7.5 |
News
- Patch Now: Critical PTC Windchill Vulnerabilitysans-newsbites-mail,
- Hackers exploit critical PTC Windchill PLM software flawcsoonline,
- First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wildsecurityweek,
- KEV: Lantronix, Ubiquiti UniFi OS, PTC Windchill and FlexPLM, and Cisco Unified Communications Managersans-newsbites-mail,