First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild

Cybersecurity officials have confirmed the first-ever exploitation of PTC Windchill, a widely-used product lifecycle management platform, in real-world attacks. The vulnerability, tracked as CVE-2026-12569, allows remote attackers to execute arbitrary code without authentication, and hackers have been using it to deploy webshells for remote command execution and data exfiltration. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by June 28, with particular concern for industrial and manufacturing sectors including aerospace, defense, and automotive companies that rely heavily on Windchill.