CISA and BSI warn orgs of critical PTC Windchill and FlexPLM flaw

CISA warns of a critical flaw in PTC Windchill and FlexPLM (CVE-2026-4681), with no patch yet and potential for imminent exploitation.

CISA issued an advisory about a critical vulnerability, tracked as CVE-2026-4681 (CVSS score of 10.0), in PTC’s Windchill and FlexPLM software. At this time, no patches are available, and no active attacks have been confirmed, but German media outlet Heise suggests exploitation could be imminent. Organizations are urged to stay alert and apply mitigations while awaiting updates.

“The vulnerability is a Remote Code Execution (RCE) issue that may be exploited through deserialization of untrusted data” reads the advisory by the vendor, which includes mitigations and indicators of compromise (IoCs).

PTC FlexPLM is a software solution for Product Lifecycle Management (PLM) that helps companies manage product data and processes. PTC Windchill is a product lifecycle management software that helps companies manage product data and processes throughout the entire product lifecycle.

An anonymous source reported the vulnerability to CISA

The critical vulnerability triggered an unprecedented response in Germany, where police, acting on instructions from the Federal Criminal Police Office (BKA), physically visited companies, sometimes in the middle of the night, to warn them.

“The officers handed over a copy of the letter to the sleepy administrators, which manufacturer PTC had already sent to all customers the day before and which contained instructions for a hotfix. An affected party reports: “The police were at our door at 3:30 AM.” states the Hense.”A production employee then informed the managing director, who informed me or a colleague.” He wonders about the urgency of the action: “Our servers are only accessible internally and cannot communicate with the WAN. The number of authorized clients is also severely restricted (different VLAN).””

Many administrators were surprised or irritated, especially since some did not use the affected products or had systems not exposed to external networks.

The goal was to ensure rapid awareness and mitigation, even though PTC had already notified customers. The large-scale operation, involving hundreds or even thousands of companies, is highly unusual, particularly as major cybersecurity agencies had not issued strong public alerts.

Adding confusion, PTC stated there is no evidence of active exploitation, yet released specific indicators of compromise suggesting attackers may already have weaponized the flaw. At the time, no patches were available, increasing concern about potential risks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)