A significant security vulnerability has been identified in PTC’s product lifecycle management platforms, Windchill and FlexPLM, which has become a target for Cl0p ransomware affiliates. This critical remote code execution (RCE) flaw, known as CVE-2026-12569, possesses a CVSS score of 9.3, indicating its severe impact on affected systems.
Details of the Vulnerability
The vulnerability in question arises from the deserialization of untrusted data, a flaw that can be leveraged without the need for authentication. PTC addressed this issue with a patch released on June 17. However, it was quickly noted to be exploited in the wild, prompting the company to publish indicators of compromise (IoCs) the following day. By the end of June, the vulnerability was officially included in CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Ransomware Campaigns in Action
Recent alerts from cybersecurity entities ReliaQuest and Ransom-ISAC, along with inputs from eCrime.ch and Defused, reveal active exploitation of this flaw by a Cl0p ransomware affiliate. Although the specific perpetrator remains unidentified, the techniques employed bear resemblance to previous Cl0p operations targeting enterprise software and critical data repositories, according to ReliaQuest’s observations.
The attackers have been executing a sophisticated attack sequence, beginning with a pre-authentication data disclosure at the FlexPLM WSDL endpoint, combined with a server-side vulnerability in the Windchill login servlet. This chain of exploits facilitates remote code execution, enabling the deployment of JSP webshells for unauthorized access.
Impact and Mitigation Strategies
Since July 20, the threat actors have expanded their targets to encompass sectors such as aerospace, automotive, manufacturing, and retail/apparel, as reported by Ransom-ISAC. Part of their strategy involves sending extortion emails, with subject lines indicating serious data leaks in the Windchill PDMLink module, to numerous users within affected companies.
Interestingly, as of July 22, Cl0p has not yet publicized the victim list from this campaign on their dark web data leak site, nor have they taken responsibility for these recent activities. Organizations are strongly urged to implement PTC’s patches and utilize both previously issued and newly identified IoCs for threat hunting. Additionally, following PTC’s recommended remediation steps is crucial to fortifying defenses against these exploits.
For further related updates, consider reading about US warnings on Iranian hackers targeting critical infrastructure devices, or Rockwell’s recent patch for code execution flaws.
