CVE-2026-77644: CWE-306 Missing authentication for critical function in PTC Windchill Risk and Reliability Enterprise Edition (Formerly Relex)

This vulnerability (CVE-2026-77644) involves missing authentication controls on a critical function within PTC Windchill Risk and Reliability Enterprise Edition, versions 11.1 through 13.1. This allows an unauthenticated attacker to bypass access controls, potentially compromising confidentiality, integrity, and availability of the system. The CVSS 4.0 vector indicates it is remotely exploitable without privileges or user interaction, with high impact on all security properties. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function) and CWE-620 (Unverified Password Change).

Successful exploitation could allow an unauthenticated attacker to bypass access controls on critical functions, leading to potential unauthorized access and manipulation of sensitive data or system operations. The high CVSS score reflects severe impact on confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or workaround information is provided, users should monitor official PTC advisories for updates. Until a fix is available, restrict network access to the affected service where possible and apply compensating controls to limit exposure.