PTC's remediation strategy
Oracle has publicly disclosed a vulnerability in Java, identified as CVE-2026-91403, that allows for unauthenticated use of code. They recommend the removal of certain certificates until a new version of Java can be provided. Other Java providers such as OpenJDK and AWS Corretto appear to have the same vulnerability.
PTC does not distribute Java with its product releases; however, some PTC products depend on Java as a required component. If Java is installed on a deployed system, the system may be affected.
For self-managed environments, please review Oracle's security alert and apply the recommended remediation as appropriate.
For PTC Cloud-hosted customers, emergency maintenance is ongoing.
Refer to this Technical Support Article for additional information and support.
PTC Cloud
In response to the Java vulnerability disclosure, PTC Cloud is applying all formally recommended actions, where applicable, to protect against CVE-2026-91403 as part of our Cloud offerings. Additionally, environments are scanned to ensure Java executables and libraries present are updated.
If you have any questions or concerns, please send your inquires to [email protected] and we will respond to you as soon as possible.