PTC vulnerabilities
We track 20 vulnerabilities in PTC products across 20 products. 20 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 11, 2026.
Latest PTC vulnerabilities
- 9.0 Critical severity
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and…
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
- 7.7 High severity
Windchill PDMLink: Deserialization of Untrusted Data
A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
- 9.2 Critical severity
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and…
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
- 9.8 Critical severity
PTC Windchill and FlexPLM Improper Input Validation Exploited
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified
- 9.3 Critical severity
Windchill PDMLink: Improper Control of Generation of Code
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.
- 10.0 Critical severity
Creo Elements/Direct License: Missing Authorization
PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server.
- 7.8 High severity
Kepware KEPServerEX: Uncontrolled Search Path Element
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.
- 7.3 High severity
Kepware KEPServerEX: Uncontrolled Search Path Element
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims int
- 7.5 High severity
KEPServerEX: Out-of-bounds Write
PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create co
- 8.0 High severity
Vuforia Studio: Cross-Site Request Forgery
PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack.
- 9.1 Critical severity
KEPServerEX: Improper Restriction of Operations within the Bounds of a Memory Buffer
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conver
- 9.8 Critical severity
KEPServerEX: Stack-based Buffer Overflow
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conver
- 9.8 Critical severity
ThingWorx Edge C-SDK: Improper Validation of Array Index
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.
- 9.8 Critical severity
ThingWorx Edge C-SDK: Integer Overflow or Wraparound
The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code.
- 7.5 High severity
Axeda agent: Improper Check for Unusual or Exceptional Conditions
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exception. Services using said function do not handle the exception. Successful exploitation of this vulnera
- 9.8 Critical severity
Axeda agent: Missing Authentication for Critical Functionality
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific port without proper authentication. Successful exploitation of this vulnerability
- 7.5 High severity
Axeda agent: Missing Authentication for Critical Functionality
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain command to a specific port without authentication. Successful exploitation of this vulnerability could allo
- 7.5 High severity
Axeda agent: Improper Limitation of a Pathname to a Restricted Directory
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) is vulnerable to directory traversal, which could allow a remote unauthenticated attacker to obtain fi
- 9.8 Critical severity
Axeda agent: Missing Authentication for Critical Functionality
Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker
- 8.8 High severity
Axeda agent: Use of Hard-coded Credentials
Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitation of this vulnerability could allow a remote authenticated attacker to take full remote control of t