Reported by 3 outlets
First-Ever Exploitation of PTC Windchill Vulnerability (CVE-2026-12569) — CISA Adds to KEV, Manufacturing PLM Systems in Crosshairs
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-12569 is an improper input validation flaw (CVSS 9.3) in PTC Windchill PDMlink and FlexPLM that grants unauthenticated remote code execution; CISA added it to KEV on June 25. Attackers deploy JSP webshells using exactly 16 lowercase hex characters in the filename under /Windchill/login/, observed as POST targets. This is the first confirmed in-the-wild exploitation of any Windchill vulnerability, with Clop operators using it for data-theft extortion against manufacturing and retail supply chains.
The exposure is sharper than a generic RCE because PLM systems hold unreleased product designs and supplier contracts, making exfiltration more damaging than encryption alone. Clop has already sent extortion emails from support@cryptohox.com targeting internet-exposed instances, and the hex-named webshell naming convention suggests automated deployment rather than manual operator access. With CISA confirming active exploitation and no prior Windchill exploitation history, defenders have no baseline telemetry to fall back on.
Patch PTC Windchill and FlexPLM immediately using the vendor releases. Hunt for anomalous POST requests to paths matching /Windchill/login/[0-9a-f]{16}.jsp. Block email domains tied to extortion outreach. Identify all internet-facing PLM instances and restrict network access to management interfaces; review access logs for unexpected JSP uploads since June 25.
Watch for additional named Clop victims and whether the hex webshell naming convention shifts, which would indicate updated tooling. Monitor CISA KEV updates for changes to exploitation status or new affected versions.
Timeline
-
original reporting
First-Ever Exploitation of PTC Windchill Vulnerability (CVE-2026-12569) — CISA Adds to KEV, Manufacturing PLM Systems in Crosshairs
securityweek.com · 110d ago · June 26th, 2026
CISA has added CVE-2026-12569 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a critical remote code execution vulnerability in PTC Windchill PDMlink and FlexPLM — product lifecycle management software used extensively in manufacturing and retail supply chains.
The flaw is an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request. This is the first known in-the-wild exploitation of a Windchill vulnerability. PTC has released patches. Attacker naming convention observed: webshells use 16 lowercase hex characters — security teams should hunt for POST requests to
/Windchill/login/[0-9a-f]{16}.jsp.Recommended action: Patch PTC Windchill and FlexPLM immediately. Monitor for anomalous POST requests to Windchill login endpoints with hex-named JSP files.
-
update from bleepingcomputer.com
Clop Ransomware Exploits CVE-2026-12569 (CVSS 9.3) to Target Windchill, FlexPLM
bleepingcomputer.com · 82d ago · July 24th, 2026
The Clop/Cl0p ransomware gang is actively exploiting CVE-2026-12569, a critical improper input validation vulnerability (CVSS 9.3) in PTC Windchill and FlexPLM enterprise systems, in a data-theft extortion campaign documented by ReliaQuest and Ransom-ISAC. Key details:
-
Exploitation enables unauthenticated remote code execution
-
Clop operators deploy JSP webshells to exfiltrate sensitive product data
-
Extortion emails sent from
support@cryptohox.com(multiple variants) -
Targets Internet-exposed Windchill and FlexPLM instances
-
Attribution to Cl0p based on tradecraft overlap with prior enterprise-targeting campaigns
-
CVE-2026-12569 already on CISA KEV since June 25
Action: Immediately identify and patch all Internet-exposed PTC Windchill and FlexPLM instances. Block email domains associated with extortion outreach.
-
-
update from cyberscoop.com
The long tail of Clop’s PTC hack is just beginning to emerge Cybercrime group Clop exploited critical zero-day vulnerability CVE-2026-12569
cyberscoop.com · 10d ago · October 3rd, 2026
The long tail of Clop’s PTC hack is just beginning to emerge Cybercrime group Clop exploited critical zero-day vulnerability CVE-2026-12569
via Mastodon https://cyberscoop.com/clop-zero-day-attacks-ptc-windchill-flexplm/