Vulnerability · Published Aug 20, 2026 · Assigned by PTC
CVE-2026-77644Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition
Critical 9.3
In plain English
A critical-severity missing authentication in Windchill Risk and Reliability Enterprise Edition (Formerly Relex) from PTC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.4%top 62.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PTC | Windchill Risk and Reliability Enterprise Edition (Formerly Relex) | 11.1 – through 13.1 |
Weakness: CWE-306, CWE-620 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/RE:M/U:Red
References
- https://www.ptc.com/en/support/article/CS474818 vendor-advisory, permissions-required