CVE-2026-12569 is an improper input validation vulnerability in PTC Windchill and FlexPLM products that permits remote, unauthenticated attackers to execute arbitrary code through specially crafted requests. The vulnerability has been actively exploited in the wild, with attackers deploying persistent JSP webshells facilitating remote command execution and data theft. PTC began releasing patches and mitigations on June 17, 2026. The Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog, instructing federal agencies to remediate by June 28, 2026. This marks the first confirmed exploitation of a PTC product vulnerability and highlights a significant threat to critical supply chains and operational technology environments in sectors such as automotive, aerospace, defense, and heavy machinery.

Successful exploitation allows remote, unauthenticated attackers to execute arbitrary code on affected systems, leading to potential persistent access via JSP webshells and enabling data exfiltration. Given Windchill's widespread use in critical industrial and manufacturing sectors, this vulnerability poses a substantial risk to supply chain integrity and operational technology environments.

Official patches and mitigations for CVE-2026-12569 have been released by PTC starting June 17, 2026. Organizations are strongly advised to apply these updates promptly. CISA has mandated remediation by June 28, 2026, for federal agencies. The vendor has also published indicators of compromise to assist in detection. Since the vulnerability is actively exploited, applying the official patches is the primary recommended action.