# CVE-2026-77646: PTC Windchill PDMLink server-side request forgery via deserialization

Source: https://junglewise.ai/threats/cve-2026-77646-ptc-windchill-pdmlink-server-side-request-forgery-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77646 · Severity: info · Published 2026-08-20

PTC Windchill PDMLink is a product lifecycle management system used to manage engineering designs and product data across organizations. A server-side request forgery vulnerability in the deserialization functionality could allow an attacker to make unauthorized network requests from the server, potentially accessing internal systems, exfiltrating sensitive data, or launching attacks against backend infrastructure that would normally be restricted from external access.

Technologies: [PTC FlexPLM](https://junglewise.ai/threats/technologies/flexplm). Vendors: [PTC](https://junglewise.ai/threats/vendors/ptc).

## Quick answers

**Is CVE-2026-77646 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77646 being exploited in the wild.

**How severe is CVE-2026-77646?** Informational severity, published 20 August 2026.

**Which products and versions are affected?** PTC Windchill PDMLink; PTC FlexPLM.

**Is there a fix for CVE-2026-77646?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77646 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77646?** Check whether you run PTC FlexPLM or PTC Windchill PDMLink. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in PTC Windchill PDMLink that is triggered through deserialization of untrusted data. The vulnerability allows an attacker to craft malicious serialized input that, when deserialized by the application, causes the server to make arbitrary network requests to internal or external systems. The attack likely requires network access to the application endpoint accepting the untrusted serialized data. Successful exploitation enables information disclosure from internal systems and potential lateral movement within the network. Patch availability status is unknown from the available references.

## Affected products

- PTC Windchill PDMLink
- PTC FlexPLM

## Timeline

- 2026-08-20: disclosed

## References

- [https://www.ptc.com/en/support/article/CS474826](https://www.ptc.com/en/support/article/CS474826)

## Related threats

- [PTC Windchill and FlexPLM remote code execution via deserialization](https://junglewise.ai/threats/cve-2026-126325-a-critical-remote-code-execution-rce-vulnerability-has-been)
- [PTC Windchill deserialization remote code execution](https://junglewise.ai/threats/cve-2026-77645-ptc-windchill-deserialization-remote-code-execution)
- [PTC Windchill and FlexPLM remote code execution via deserialization](https://junglewise.ai/threats/cve-2026-12569-ptc-windchill-and-flexplm-remote-code-execution-via)