CVE-2026-4681
PTC Windchill PDMLink
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.
Ransomware groups exploiting CVE-2026-4681
The ransomware group known as Cl0p is a variant of a previously known strain dubbed CryptoMix. It is worth noting that this variant was delivered as the final payload in a phishing campaign in 2019 and was exclusively financially motivated, with attacks carrie
Exploitation is attributed to these groups across their recorded activity. It does not follow that every organisation they listed was reached through CVE-2026-4681 — the source data does not record an entry point per incident.
Exploitation status
EPSS — exploitation probability
FIRST puts the probability of exploitation activity in the next 30 days at 0.8%, which is higher than 53.6% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.
Recent listings by these groups
Disclosures from the groups above, newest first.
Frequently asked questions
Is CVE-2026-4681 being exploited by ransomware groups?
Yes. CVE-2026-4681 is recorded as exploited by Clop. Between them these groups account for 854 victim disclosures in this database.
What does CVE-2026-4681 affect?
CVE-2026-4681 affects PTC Windchill PDMLink. A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.
How severe is CVE-2026-4681?
CVE-2026-4681 is rated CRITICAL with a CVSS base score of 9.3. EPSS puts the probability of exploitation in the next 30 days at 0.8%, higher than 53.6% of all scored vulnerabilities. It is not currently in the CISA Known Exploited Vulnerabilities catalog.
How should organisations respond to CVE-2026-4681?
Apply the vendor patch for PTC Windchill PDMLink as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.