CVE-2026-77645: CWE-20 Improper input validation in PTC Windchill PDMLink

This vulnerability (CVE-2026-77645) in PTC Windchill PDMLink and PTC FlexPLM is due to improper input validation (CWE-20) and unsafe deserialization of untrusted data (CWE-502). Successful exploitation could lead to remote code execution without requiring user interaction or privileges, but with high attack complexity. The vulnerability affects specific versions of Windchill PDMLink, including 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, and 13.1.3.0. No official patch or remediation information is provided in the source data.

If exploited, this vulnerability allows an unauthenticated attacker to execute arbitrary code remotely on affected systems. This could lead to full system compromise, data theft, or disruption of services. The CVSS 4.0 score of 9.2 reflects critical impact with high confidentiality, integrity, and availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, organizations should monitor vendor communications closely and consider applying any recommended temporary mitigations once available. Avoid processing untrusted data inputs where possible until a fix is applied.