PTC Windchill Flaw Exploited in Reported Extortion Campaign
Summary
Reports say a Cl0p affiliate exploited unauthenticated RCE CVE-2026-12569 in PTC Windchill and FlexPLM, deploying JSP webshells and exfiltrating data for extortion. The actor attribution remains unconfirmed, and Cl0p has not publicly claimed the campaign.
Key points
- CVE-2026-12569 is an unauthenticated deserialization flaw rated CVSS 9.3, affecting PTC Windchill and FlexPLM.
- PTC patched the flaw on June 17; it was flagged as exploited in the wild the next day, and added to CISA’s KEV catalog later in June.
- ReliaQuest and Ransom-ISAC report that attackers chained a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side Windchill login servlet flaw to achieve RCE and deploy JSP webshells.
- The reports describe filesystem enumeration, data staging, and exfiltration for extortion; the actor behind the activity remains unconfirmed.
- The campaign reportedly targeted aerospace, automotive, manufacturing, and retail/apparel organizations starting July 20.
- As of July 22, Cl0p had not publicly claimed the campaign or listed its victims on its leak site.
- Organizations are advised to apply PTC patches, use published IoCs for threat hunting, and follow PTC’s remediation steps.
Article Details
- Vulnerability Types
- Deserialization of untrusted data
- Pre-authentication information disclosure
- Remote code execution
- Severity
- Critical (CVSS 9.3)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1074 · Data StagedAfter initial access, attackers were observed staging data before exfiltration for extortion.T1083 · File and Directory DiscoveryAfter gaining access, attackers were observed enumerating filesystems.T1190 · Exploit Public-Facing ApplicationA Cl0p affiliate was reported to exploit the unauthenticated Windchill vulnerability for initial access and remote code execution.T1505.003 · Web ShellAttackers deployed JSP webshells after exploiting the Windchill and FlexPLM vulnerabilities.
CVE
Threat Actors
Malware
Vendors
Products
PTC FlexPLMA Cl0p ransomware affiliate has been observed exploiting a critical-severity remote code execution (RCE) vulnerability in PTC’s product lifecycle management (PLM) platforms Windchill and FlexPLM.PTC WindchillA Cl0p ransomware affiliate has been observed exploiting a critical-severity remote code execution (RCE) vulnerability in PTC’s product lifecycle management (PLM) platforms Windchill and FlexPLM.
Industries
AerospaceStarting July 20, the attackers have been targeting organizations across the aerospace, automotive, manufacturing, and retail/apparel sectors, Ransom-ISAC’s advisory reads.AutomotiveStarting July 20, the attackers have been targeting organizations across the aerospace, automotive, manufacturing, and retail/apparel sectors, Ransom-ISAC’s advisory reads.ManufacturingStarting July 20, the attackers have been targeting organizations across the aerospace, automotive, manufacturing, and retail/apparel sectors, Ransom-ISAC’s advisory reads.Retail/apparelStarting July 20, the attackers have been targeting organizations across the aerospace, automotive, manufacturing, and retail/apparel sectors, Ransom-ISAC’s advisory reads.