Cl0p Exploits PTC Windchill and FlexPLM RCE

A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2026-12569, is being actively exploited by Cl0p ransomware affiliates. The campaign targets Internet-facing PTC Windchill PDMlink and PTC FlexPLM systems, which are widely used for product lifecycle management. Attackers chain a pre-authentication information disclosure flaw with a deserialization vulnerability to achieve unauthenticated code execution and system compromise.

Following successful exploitation, adversaries are deploying persistent JSP webshells to facilitate intellectual property theft and file system discovery. This activity frequently serves as a precursor to double-extortion ransomware attacks. Organizations utilizing these PTC solutions are urged to apply vendor-provided security patches immediately and conduct a thorough hunt for indicators of compromise within their environments.

Failure to remediate poses a severe risk of full system takeover, unauthorized access to sensitive engineering and design data, and enterprise-wide ransomware deployment. The targeting of PLM systems highlights a strategic focus on high-value intellectual property and critical industrial processes.