Critical RCE Vulnerability in PTC Windchill and FlexPLM Under Active Exploitation

Hackers are actively exploiting a critical unsafe-deserialization vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM that enables remote code execution; PTC released patches on June 17, 2026 and CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 25. With a CVSS score of 9.3 and reported active exploitation affecting industries including defense and aerospace, indicators of compromise have been shared and organizations are strongly urged to apply patches and enhance monitoring to mitigate data theft and system compromise risks.