Remote code execution via unsafe deserialization

Deserialization of untrusted data in PTC Windchill PDMLink and FlexPLM allows remote attackers to execute arbitrary code. PTC has not disclosed the vulnerable class or method, but its interim mitigations block requests to the WindchillGW and WindchillAuthGW servlet path for com.ptc.wvs.server.publish.Publish, indicating that attacker-controlled serialized data reaches that publish endpoint. Publicly accessible deployments are the primary exposure, and successful exploitation grants code execution on the application server with no published indication that authentication or user interaction is required.