PTC vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited PTC flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-12569 PTC Windchill and FlexPLM Improper Input ValidationExploited since Jun 25, 2026 · ransomware · CVSS 9.3

Latest high and critical flaws

• CVE-2026-77646 A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM.High 7.7 · Aug 20, 2026
• CVE-2026-77645 A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM.Critical 9.2 · Aug 20, 2026
• CVE-2026-77644 A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition.Critical 9.3 · Aug 20, 2026
• CVE-2026-12569 PTC Windchill and FlexPLM Improper Input ValidationExploited · Critical 9.3 · Jun 17, 2026
• CVE-2026-4681 A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM.Critical 9.3 · Mar 23, 2026
• CVE-2024-6071 PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the seCritical 10 · Jun 27, 2024
• CVE-2024-3951 PTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code.High 7.1 · May 8, 2024
• CVE-2023-29445 An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges High 7.8 · Jan 10, 2024
• CVE-2023-5909 KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.High 7.5 · Nov 30, 2023
• CVE-2023-5908 KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.Critical 9.1 · Nov 30, 2023
• CVE-2023-4296 ​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in tHigh 8.8 · Aug 29, 2023
• CVE-2023-3825 PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption.High 7.5 · Jul 31, 2023
• CVE-2023-27881 A user could use the “Upload Resource” functionality to upload files to any location on the disk.High 8 · Jun 7, 2023
• CVE-2023-0755 The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitraryCritical 9.8 · Feb 23, 2023
• CVE-2023-0754 The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to crash the server and remotely execute arbitrary coCritical 9.8 · Feb 23, 2023
• CVE-2022-25252 When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exceptioHigh 7.5 · Mar 16, 2022
• CVE-2022-25251 When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messaCritical 9.8 · Mar 16, 2022
• CVE-2022-25250 When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain commandHigh 7.5 · Mar 16, 2022
• CVE-2022-25249 When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) isHigh 7.5 · Mar 16, 2022
• CVE-2022-25247 Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentCritical 9.8 · Mar 16, 2022
• CVE-2022-25246 Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation.Critical 9.8 · Mar 16, 2022
• CVE-2018-20092 PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request.High 7.5 · Dec 17, 2018
• CVE-2018-17217 An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2.High 7.5 · Sep 30, 2018
• CVE-2015-2061 Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving setting a large buffeHigh 7.5 · Mar 9, 2015