CTI · reviewed · 2026-10-03

First-Ever Exploitation of PTC Windchill Vulnerability (CVE-2026-12569) — CISA Adds to KEV, Manufacturing PLM Systems in Crosshairs

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1100 Web Shell Persistence

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: PTC Windchill Hex-Named JSP Webshell Upload
id: b8d463ab-5308-4bb9-8f5f-a6bb3f04589e
status: experimental
description: >
    Detects exploitation of CVE-2026-12569 against PTC Windchill PDMlink and
    FlexPLM: HTTP POST requests targeting JSP files whose names are exactly 16
    lowercase hexadecimal characters under the /Windchill/login/ path. Clop
    operators deploy these hex-named JSP webshells for data-theft extortion,
    and the automated naming convention is the stable observable in an
    otherwise first-of-its-kind exploitation campaign.
references:
  - https://www.securityweek.com/first-ever-exploitation-of-ptc-windchill-vulnerability-discovered-in-the-wild/
  - https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks/
author: Tia N. List
date: 2026/10/03
tags:
  - attack.t1190
  - attack.initial-access
  - attack.t1100
  - attack.persistence
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri|re: '/Windchill/login/[0-9a-f]{16}\.jsp'
  condition: selection
falsepositives:
  - Legitimate Windchill or third-party automation posting to generated JSP pages under the login path (rare)
level: high

References

• https://www.securityweek.com/first-ever-exploitation-of-ptc-windchill-vulnerability-discovered-in-the-wild/
• https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks/
• https://cyberscoop.com/clop-zero-day-attacks-ptc-windchill-flexplm/