Read the docs

PTC

Records44All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical17CVSS 9.0–10.0
CVSS high16CVSS 7.0–8.9

Exploited now

PTC records in CISA KEV
TI-2026-10780 PTC Windchill and FlexPLM Improper Input Validation Vulnerability Priority CRITICAL 99KEV 2026-06-25

Components

Products in the NVD configurations · select one to filter the records
Thingworx Industrial Connectivity 13 records MEDIUM Thingworx Kepware Server 11 records MEDIUM Kepware Kepserverex 9 records MEDIUM Axeda Agent 7 records MEDIUM Axeda Desktop Server 7 records MEDIUM Opc-aggregator 7 records MEDIUM Thingworx Kepware Edge 6 records MEDIUM Vuforia Studio 6 records MEDIUM

Records

11 records in Thingworx Kepware Server · all components

TI-2020-16591 CVE-2020-27265 · GHSA-355x-g6q7-4c7g

Stack-based buffer overflow in PTC Kepware KEPServerEX; ThingWorx Industrial…

Priority MEDIUM 56

KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway S…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.12504 Published 2021-01-13 No fix listed CWE-121
TI-2022-02619 CVE-2022-2825 · GHSA-6rww-x4m5-6j62

Stack-based buffer overflow in Kepware KEPServerEX

Priority MEDIUM 55

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03402 Published 2023-03-29 No fix listed CWE-121
TI-2022-02641 CVE-2022-2848 · GHSA-f952-wvmx-6w24

Heap-based buffer overflow in Kepware KEPServerEX

Priority MEDIUM 51

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.03366 Published 2023-03-29 No fix listed CWE-122
TI-2020-16593 CVE-2020-27267 · GHSA-mr5h-jvqg-8jg8

Use after free in PTC Kepware KEPServerEX

Priority MEDIUM 48

KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway S…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05986 Published 2021-01-13 No fix listed CWE-416
TI-2020-16589 CVE-2020-27263 · GHSA-66v8-hp22-2q37

Heap-based buffer overflow in PTC Kepware KEPServerEX

Priority MEDIUM 48

KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway S…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05986 Published 2021-01-13 No fix listed CWE-122
TI-2023-05440 CVE-2023-5908 · GHSA-m695-35xv-pjcm

Heap Based Buffer Overflow in PTC KEPServerEx

Priority MEDIUM 41

KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00962 Published 2023-11-30 No fix listed CWE-122
TI-2023-13825 CVE-2023-29445 · GHSA-3hx8-rcv2-389f

Uncontrolled Search Path Element in PTC's Kepware KEPServerEX

Priority LOW 36

An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00236 Published 2024-01-10 No fix listed CWE-427
TI-2023-13824 CVE-2023-29444 · GHSA-w876-744c-hf5g

Uncontrolled Search Path Element in PTC's Kepware KEPServerEX

Priority LOW 33

An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00196 Published 2024-01-10 No fix listed CWE-427
TI-2023-13827 CVE-2023-29447 · GHSA-q2hf-f8g9-p54v

Insufficiently Protected Credentials in PTC's Kepware KEPServerEX

Priority LOW 28

An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.

CVSS 3.1MEDIUM 5.7 Adjacent network No auth User interaction EPSS 0.00363 Published 2024-01-10 No fix listed CWE-522
TI-2023-13826 CVE-2023-29446 · GHSA-pj7r-qcr7-gx8f

Improper Input Validation in PTC's Kepware KEPServerEX

Priority LOW 21

An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file.

CVSS 3.1MEDIUM 4.7 Local No auth User interaction EPSS 0.00244 Published 2024-01-10 No fix listed CWE-40
Open these records in search →