CVE-2026-77646
published 2026-08-20CVE-2026-77646: A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the…
PriorityP344high7.7CVSS 4.0
AVNACLATNPRNUINVCNVINVANSCHSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUYRUVDREMURed
EPSS
0.44%
36.6th percentile
A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ptc | flexplm | — | — |
| ptc | flexplm | — | — |
| ptc | flexplm | — | — |
| ptc | flexplm | — | — |
| ptc | flexplm | — | — |
| ptc | flexplm | — | — |
| ptc | flexplm | — | — |
| ptc | flexplm | — | — |
| ptc | flexplm | — | — |
| ptc | flexplm | — | — |
| ptc | windchill_pdmlink | — | — |
| ptc | windchill_pdmlink | — | — |
| ptc | windchill_pdmlink | — | — |
| ptc | windchill_pdmlink | — | — |
| ptc | windchill_pdmlink | — | — |
| ptc | windchill_pdmlink | — | — |
| ptc | windchill_pdmlink | — | — |
| ptc | windchill_pdmlink | — | — |
| ptc | windchill_pdmlink | — | — |
| ptc | windchill_pdmlink | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
PTC Windchill PDMLink/FlexPLM server-side request forgery (EUVD-2026-63756)
vuldb·2026-08-21·CVSS 7.7
CVE-2026-77646 [HIGH] PTC Windchill PDMLink/FlexPLM server-side request forgery (EUVD-2026-63756)
A vulnerability was found in PTC Windchill PDMLink and FlexPLM and classified as critical. The impacted element is an unknown function. Such manipulation leads to server-side request forgery.
This vulnerability is referenced as CVE-2026-77646. It is possible to launch the attack remotely. No exploit is available.
GHSA
A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM.
ghsa_unreviewed·2026-08-21
CVE-2026-77646 [HIGH] CWE-502 A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM.
A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-20
Published