CVE-2026-77646

A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

CVSS

No CVSS.

References

Link	Resource
https://www.ptc.com/en/support/article/CS474826

Configurations

No configuration.

History

26 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) ha sido reportada en PTC Windchill PDMLink y PTC FlexPLM. La vulnerabilidad puede ser explotada a través de la deserialización de datos no confiables.

Information

Published : 2026-08-20 22:18

Updated : 2026-10-26 10:10

NVD link : CVE-2026-77646

Mitre link : CVE-2026-77646

CVE.ORG link : CVE-2026-77646

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-77646", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77646", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:49:33.203565Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "0b655efc-079c-4cb9-9e8d-164871239f4e", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 7.7, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "0b655efc-079c-4cb9-9e8d-164871239f4e", "affectedData": [{"vendor": "PTC", "product": "Windchill PDMLink", "versions": [{"status": "affected", "version": "11.0 M030"}, {"status": "affected", "version": "11.1 M020"}, {"status": "affected", "version": "11.2.1.0"}, {"status": "affected", "version": "12.0.2.0"}, {"status": "affected", "version": "12.1.2.0"}, {"status": "affected", "version": "13.0.2.0"}, {"status": "affected", "version": "13.1.0.0"}, {"status": "affected", "version": "13.1.1.0"}, {"status": "affected", "version": "13.1.2.0"}, {"status": "affected", "version": "13.1.3.0"}], "defaultStatus": "unaffected"}, {"vendor": "PTC", "product": "FlexPLM", "versions": [{"status": "affected", "version": "11.0 M030"}, {"status": "affected", "version": "11.1 M020"}, {"status": "affected", "version": "11.2.1.0"}, {"status": "affected", "version": "12.0.0.0"}, {"status": "affected", "version": "12.0.2.0"}, {"status": "affected", "version": "12.0.3.0"}, {"status": "affected", "version": "12.1.2.0"}, {"status": "affected", "version": "12.1.3.0"}, {"status": "affected", "version": "13.0.2.0"}, {"status": "affected", "version": "13.0.3.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-20T22:18:06.657", "references": [{"url": "https://www.ptc.com/en/support/article/CS474826", "source": "0b655efc-079c-4cb9-9e8d-164871239f4e"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "0b655efc-079c-4cb9-9e8d-164871239f4e", "description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A\u00a0Server-Side Request Forgery (SSRF) vulnerability has been\u00a0reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data."}, {"lang": "es", "value": "Una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) ha sido reportada en PTC Windchill PDMLink y PTC FlexPLM. La vulnerabilidad puede ser explotada a trav\u00e9s de la deserializaci\u00f3n de datos no confiables."}], "lastModified": "2026-10-26T10:10:00.140", "sourceIdentifier": "0b655efc-079c-4cb9-9e8d-164871239f4e"}

CVE-2026-77646

JSON object

Attach tags to CVE-2026-77646

Attach tags to `CVE-2026-77646`