Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
Summary: Threat actors linked to the Cl0p ransomware campaign are exploiting internet-exposed PTC Windchill and FlexPLM deployments, chaining a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet to achieve unauthenticated remote code execution and deploy hex-named JSP web shells under /Windchill/login/. The activity is suspected to exploit CVE-2026-12569 (CVSS 9.3), added to CISA's KEV catalog late last month, and targets manufacturing, automotive, aerospace, and retail sectors for double extortion data theft.
Key Takeaway: Censys counted a little over 80 internet-exposed Windchill instances as of July 20, 2026, with 80% in the U.S. and nearly a quarter on Akamai infrastructure - and the data at risk includes product designs, bills of materials, and supplier data belonging to defense contractors, energy suppliers, and medical technology companies.
Read the original at The Hacker News ↗
- Topics
- Ransomware
- Mentions
- CVE-2026-12569
- Related
- CVE-2026-12569: PTC Windchill and FlexPLM Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Jun 25, 2026