CVE-2026-77646: Server Side Request Forgery (SSRF) vulnerability reported in Windchill

Description

A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Scores

CVSS scores of CVE-2026-77646, by who scored it
Scored by	CVSS	Score	Vector
PTCCNA (assigner)	4.0	High7.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/R:U/V:D/RE:M/U:Red
NVDNVD · Deferred	4.0	High7.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red

EPSS (exploitation in 30 days): 0.44% · top 62% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.7.

Weakness

CWE-502 Deserialization of untrusted data (opens in a new tab)All about CWE-502 and its CVEs
CWE-918 Server-Side request forgery (SSRF) (opens in a new tab)All about CWE-918 and its CVEs

Affected products

PTC · Windchill PDMLink
- affected 11.0 M030
- affected 11.1 M020
- affected 11.2.1.0
- affected 12.0.2.0
- affected 12.1.2.0
- affected 13.0.2.0
- affected 13.1.0.0
- affected 13.1.1.0
- affected 13.1.2.0
- affected 13.1.3.0
PTC · FlexPLM
- affected 11.0 M030
- affected 11.1 M020
- affected 11.2.1.0
- affected 12.0.0.0
- affected 12.0.2.0
- affected 12.0.3.0
- affected 12.1.2.0
- affected 12.1.3.0
- affected 13.0.2.0
- affected 13.0.3.0

References (1)

https://www.ptc.com/en/support/article/CS474826 (opens in a new tab)vendor-advisorymitigationpermissions-required

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-77646](https://trackcve.app/badge/CVE-2026-77646.svg)](https://trackcve.app/cve/CVE-2026-77646)

Record last updated 21 Aug 2026, 20:08 UTC.