PTC Warns of Critical Windchill, FlexPLM Flaw Enabling Remote Code Execution

**PTC advisory:** Critical deserialization-based remote code execution (CVE-2026-4681, CVSSv3.1 10.0) affects multiple Windchill PDMLink and FlexPLM releases; PTC published Apache and IIS workarounds, recommends disconnecting or shutting down unpatched instances, and supplied IOCs (file names including GW.class and payload.bin with SHA256, JSP artifacts, user-agent and suspicious HTTP request patterns) for detection and response.