PTC Patches a Second Critical Windchill RCE in Five Months as Aras Puts the MBOM Under Change Control

On Nov. 11, PTC posted a patch for a new critical flaw in Windchill and FlexPLM, its PLM systems for engineering and for retail and apparel product development. The bug, CVE-2026-126325, is a deserialization of untrusted data that can let an attacker run code on the server with crafted requests, and it scores 9.2 out of 10 on CVSS v4. Affected releases run from Windchill 11.0 M030 through 13.1.4.0 and FlexPLM 11.0 M030 through 13.1.3.0. PTC says environments it hosts are already patched, and it urges everyone running their own servers to apply the fix (support article CS483249) as soon as possible.

This is the second critical remote-code-execution hole in the same products in about five months. The earlier one, CVE-2026-12569 (CVSS 9.3), was exploited in the wild, and The Hacker News reports that in July, actors linked to the Cl0p ransomware group used it to drop JSP web shells and pull product data out of manufacturers. PTC’s advisory still carries a running list of attacker IP addresses and other indicators of compromise, updated as late as Aug. 26. “PTC software is a textbook target for initial access brokers and ransomware operators,” watchTowr’s Yordan Ganchev told the publication. A PLM vault holds every drawing, BOM and supplier spec a company has, which is exactly why it gets attacked.

Cutaway of an AlliedSignal aircraft auxiliary power unit showing its compressor and turbine section, on display in a museum. — Cutaway of an AlliedSignal aircraft auxiliary power unit. Aeronamic, the first European customer of Aras’s new accelerator, builds turbomachinery and engine-driven systems for aerospace. Photo: Daderot, CC0, via Wikimedia Commons.

On the data side, Aras on Nov. 12 released its Digital Manufacturing Engineering Accelerator for Aras Innovator. It targets a habit most plants still have: once the engineering BOM settles, someone rebuilds the manufacturing BOM in a spreadsheet or in ERP, and each plant then edits its own copy. The accelerator lets teams derive or author manufacturing parts as governed objects tied back to engineering, view the EBOM and MBOM side by side, and set applicability by plant, date, tail number or other effectivity conditions. It also flags missing parts, quantity differences and manufacturing-only content as designs change, and it adds manufacturing change requests and orders linked to the engineering change. Aras built it with JAMP, its Japanese user group of more than 50 companies.

The first European subscriber is Aeronamic, a Dutch maker of turbomachinery and engine-driven systems that supplies programs including Airbus, Boeing, Gulfstream and the F-35. Before it adopted Aras Innovator in 2012, the company ran critical data across spreadsheets, custom databases and paper. Today it runs one Aras product data environment connected to several ERP systems across its business units. “PLM is a journey,” said Ronny Blaauwgeers, Aeronamic’s director of manufacturing engineering, citing faster time to market, less material waste and full traceability.

A cleanroom worker in a white hood, mask and gloves holds a finished silicon wafer at a lab bench. — A finished silicon wafer in a cleanroom. HCLTech’s new package puts semiconductor IP, NPI and supplier data on Windchill. Photo: U.S. Department of Energy / Lawrence Livermore National Laboratory, public domain, via Wikimedia Commons.

Windchill also picked up a new industry package the same week. On Nov. 10, HCLTech launched a preconfigured semiconductor PLM solution built on Windchill, covering IP management, new product introduction, supplier collaboration, quality and regulatory compliance, and connecting to existing design, manufacturing and business systems. “Customers look for new ways to transform increasingly sophisticated product development environments,” said John Haller, PTC’s general manager of PLM. Chip IP is some of the most valuable data any company holds, which raises the stakes on keeping the server it lives on patched.

In N23D, PLM keeps the engineering BOM and every plant’s manufacturing BOM in one model, with each MBOM line traced to the engineering part it builds and its applicability set by plant and effectivity. An engineering change approved through CCB flags every MBOM, routing in MES, and order in ERP it touches, and QMS keeps the record of who approved the divergence. N23D is being built in Rust, with typed requests rather than deserialized objects, so the vault that holds all of that is not one crafted request away from running someone else’s code.

Sources

Featured photo: cabling behind rack-mounted servers in a company computer room. Photo by Jemimus, CC BY 2.0, via Wikimedia Commons.

Melotte Traced Rising CT Defects to One Laser in Minutes as Devia, Fulcrum and Catalyx Wire AI Into Deviations, CAPAs and Inspection

In N23D, a Finished Assembly Gets Graded on How It Moves, Pass or Fail