CVE-2026-77646: CWE-502 Deserialization of untrusted data in PTC Windchill PDMLink

This vulnerability (CVE-2026-77646) affects PTC Windchill PDMLink and PTC FlexPLM products and is categorized under CWE-502 (Deserialization of Untrusted Data) and CWE-918 (Server-Side Request Forgery). The flaw allows an attacker to exploit deserialization mechanisms to perform SSRF attacks, potentially causing the server to make unauthorized requests. The CVSS 4.0 base score is 7.7, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and high scope and impact on confidentiality and availability. The affected versions are explicitly enumerated, but no patch or vendor advisory is provided to confirm remediation status.

An attacker can exploit this vulnerability remotely without authentication to cause the server to make unauthorized requests (SSRF), potentially leading to information disclosure or disruption of service. The impact affects confidentiality and availability with high scope, as indicated by the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor PTC advisories for updates. Until a patch is available, consider restricting network access and applying any recommended configuration changes from the vendor to mitigate SSRF risks.