CISA added CVE-2026-12569, a critical PTC Windchill and FlexPLM remote code execution flaw, to its Known Exploited Vulnerabilities catalog with a June 28 deadline. The bug is being used to deploy JSP web shells against product lifecycle management systems that often sit deep inside manufacturing and engineering workflows.