Active Exploitation of PTC Windchill CVE-2026-12569 in Data-Theft Campaigns

The critical vulnerability CVE-2026-12569 in the PTC Windchill product is being actively exploited as part of a data-theft campaign allegedly linked to the Cl0p group. The attackers are combining this vulnerability with a separate information disclosure defect in PTC FlexPLM, which allows unauthenticated arbitrary code execution on systems exposed to the internet. According to a coordinated report by Ransom-ISAC, eCrime.ch and DEFUSED, the targets of the attacks are organizations in the industrial manufacturing, automotive, aerospace and retail sectors. Administrators of PTC Windchill and FlexPLM systems must immediately check whether their deployments are accessible from the internet and apply available fixes.

Exploitation chain: from information disclosure to remote code execution

According to the coordinated Ransom-ISAC report, the attack is built on the sequential use of two vulnerabilities. The first stage is exploitation of an information disclosure defect prior to authentication in the WSDL endpoint of the FlexPLM component (CVSS v3.1 score: 7.5). The data obtained at this stage makes it possible to move to the second stage — exploitation of a server-side vulnerability in the Windchill authorization servlet (CVE-2026-12569), which enables unauthenticated remote code execution.

As a result of successful exploitation, the attackers place JSP web shells with hexadecimal names in the /Windchill/login/ directory. These web shells provide persistent remote access to the compromised system and are used for follow-on actions: enumerating the file system, preparing to exfiltrate engineering and design data and, ultimately, carrying out a double extortion scheme.

ReliaQuest, in a separate publication, has confirmed observing active exploitation of CVE-2026-12569 to deploy JSP web shells and exfiltrate sensitive product data.

It is important to highlight a significant discrepancy between sources: the original material states that CVE-2026-12569 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog; however, verification against NVD data does not confirm this status. Organizations should rely on the confirmed fact of active exploitation in the wild rather than on the formal status in the KEV catalog.

Indicators of compromise

The coordinated report published four IP addresses associated with the attackers’ infrastructure:

• 216.152.148.54
• 216.152.151.204
• 104.243.35.63
• 5.180.41.35

According to Ransom-ISAC, these indicators match those previously circulated by PTC in its own customer notifications.

Attribution and threat context

Attribution of the campaign to the Cl0p group (also known as Chubby Scorpius, FIN11, Graceful Spider and Lace Tempest) is currently not confirmed. ReliaQuest explicitly notes that “the actor responsible for the attacks remains unconfirmed,” but the observed tactics, techniques and procedures show characteristic similarities to previous Cl0p campaigns targeting enterprise applications and repositories of high-value data.

This similarity is no accident. Cl0p has consistently specialized in exploiting vulnerabilities in widely used enterprise products. Previous campaigns by the group have targeted file transfer solutions — Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo and MOVEit Transfer — as well as Oracle E-Business Suite. The current campaign fits this pattern: PTC Windchill is one of the leading PLM platforms used by large industrial enterprises for product lifecycle management.

The extortion tactic itself deserves special attention. According to the coordinated report, ransom demand emails are sent from previously compromised email accounts and distributed to hundreds of users inside the affected organization. This creates additional pressure on management, as the fact of compromise becomes known to a wide circle of employees.

Impact assessment

The targeted sectors — industrial manufacturing, automotive, aerospace and retail — determine the nature of the potential damage. PLM systems store critically important intellectual property: design documentation, material specifications, and data on technological processes. Leakage of such data can lead to:

• Loss of competitive advantage if design documentation reaches competitors or the open market
• Violations of export control regulations (ITAR, EAR) for aerospace and defense enterprises
• Direct financial losses from extortion and incident response costs
• Disruption of production processes if compromised PLM systems need to be isolated

Recommendations for defense

Organizations using PTC Windchill and FlexPLM are advised to take the following actions in order of priority:

1. Immediately restrict internet access to Windchill and FlexPLM deployments. If direct access is required, provide it exclusively via a VPN with multi-factor authentication.
2. Check for indicators of compromise: scan the /Windchill/login/ directory for JSP files with hexadecimal names; review network logs for connections to the IP addresses listed above.
3. Apply security updates from PTC to eliminate CVE-2026-12569 and the information disclosure defect in the FlexPLM WSDL. Contact PTC for the latest guidance if updates have not yet been applied.
4. Block the specified IP addresses at the perimeter security layer (firewalls, IPS/IDS).
5. Audit email accounts for signs of compromise, given the tactic of sending ransom emails from hijacked accounts.

This campaign demonstrates a persistent trend toward exploiting enterprise PLM systems, which have traditionally received less attention from security teams than file transfer systems or web applications. Organizations operating PTC Windchill should treat remediation of CVE-2026-12569 as a top-priority task and, within the next few hours, ensure that their PLM infrastructure is not accessible from the internet without proper authentication.