Critical RCE Vulnerability in PTC Windchill and FlexPLM Exposes Systems to Attack PTC has issued an urgent advisory warning of a severe Remote Code Execution (RCE) vulnerability (CVE-2026-4681) affecting its Windchill PDMLink and FlexPLM platforms. The flaw, classified as a code injection vulnerability (CWE-94), carries a CVSS v3.1 score of 10.0 and a CVSS v4 score of 9.3, indicating maximum severity. ### Affected Versions The vulnerability impacts multiple releases, including: - Windchill PDMLink: Versions 11.0 M030 through 13.1.3.0 - FlexPLM: Versions 11.0 M030 through 13.0.3.0 - All CPS versions prior to 11.0 M030 are also vulnerable. PTC has confirmed no evidence of active exploitation but warns that the flaw poses a critical risk, particularly for publicly accessible instances. ### Exploitation Mechanism The vulnerability stems from improper handling of deserialized, untrusted data, allowing attackers to execute arbitrary code and potentially gain full system control. While internet-exposed deployments are at highest risk, PTC advises applying mitigations to all installations. ### Mitigation Steps Until official patches are released, PTC recommends the following workarounds: #### Apache HTTP Server - Create a configuration file (`90-app-Windchill-Auth.conf`) in `<APACHE_HOME>/conf/conf.d/` with the directive: ```apache <LocationMatch “^.servlet/(WindchillGW|WindchillAuthGW)/com.ptc.wvs.server.publish.Publish(?:;[^/])?/.*$”> Require all denied ``` - Ensure the file loads last and restart Apache. #### Microsoft IIS - Verify the URL Rewrite module is installed. - Modify `web.config` to include the rewrite rule as the first tag under `<system.webServer>`. - Restart IIS via `iisreset` and confirm the rule is active. PTC notes that File Server or Replica Server configurations may require adjusted steps, and older releases could need additional modifications. For organizations unable to implement mitigations immediately, PTC suggests shutting down services or disconnecting systems from the internet. ### Indicators of Compromise (IOCs) Security teams should monitor for: - Network patterns: - Suspicious User-Agent: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36` - Malicious HTTP requests: `run?p= .jsp?p=`, `run?c= .jsp?c=` - File system artifacts: - `GW.class` or `payload.bin` (SHA256: `C818011CAFF82272F8CC50B670304748984350485383EBAD5206D507A4B44FF1`) - `dpr_<8-hex-digits>.jsp` or other suspicious `.class` files (e.g., `Gen.class`, `HTTPRequest.class`). - Log anomalies: - Messages containing `GW_READY_OK`, `ClassNotFoundException for GW Windchill`, or `HTTP Gateway Exception`. PTC has deployed the Apache workaround for all cloud-hosted customers and is providing 24×7 support for affected users. Organizations detecting IOCs are urged to initiate incident response protocols.