Cl0p Exploits Critical PTC Windchill Flaw to Target 40+ Organizations

Aug 24, 2026By Manasvini R

Summary

The Cl0p cybercrime group has launched a large-scale data-theft and extortion campaign targeting organizations running vulnerable PTC Windchill and FlexPLM deployments. The campaign is associated with exploitation of CVE-2026-12569, a critical remote code execution vulnerability affecting PTC's product lifecycle management (PLM) software.

CVE-2026-12569 can be exploited through deserialization of untrusted data and allows an unauthenticated remote attacker to execute code on vulnerable systems. The vulnerability received a CVSS v3.1 score of 9.8 (Critical) from NVD and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog after active exploitation was confirmed.

Observed attacks against internet-facing Windchill and FlexPLM environments have resulted in the deployment of persistent JSP webshells inside the Windchill login directory. These webshells provide attackers with continued access to compromised application servers and support subsequent file discovery, credential access, arbitrary code execution, data staging, and exfiltration.

The campaign is particularly significant because Windchill and FlexPLM frequently contain sensitive product-development and engineering information. Reported stolen data includes engineering documents, project files, databases, backups, blueprints, diagrams, images, and other corporate information. Cl0p subsequently uses the stolen information as leverage in a data-extortion operation.

Background of the Cl0p Windchill Campaign

Cl0p is a financially motivated cybercrime operation known for conducting large-scale exploitation campaigns against enterprise software rather than compromising organizations individually through traditional phishing or endpoint-focused intrusion techniques.

Previous Cl0p campaigns have targeted widely deployed enterprise platforms such as MOVEit Transfer, GoAnywhere MFT, Cleo products, and Oracle E-Business Suite. The group typically identifies a vulnerability that provides access to valuable centralized systems, compromises multiple organizations in a short period, steals large quantities of data, and then pressures victims through public disclosure.

The PTC campaign follows the same mass-exploitation model. Internet-accessible Windchill and FlexPLM servers provide an attractive target because these platforms are used to manage product lifecycle data, engineering designs, manufacturing information, product documentation, and other intellectual property.

Threat intelligence reporting indicates that exploitation activity began around June 2026. By July, organizations were receiving extortion emails referring to serious data leakage from Windchill PDMLink. Cl0p later began publishing victim names on its data leak infrastructure, with more than 40 organizations reportedly associated with the campaign by August 2026.

The campaign demonstrates how compromise of a single internet-facing enterprise application can provide attackers with direct access to highly concentrated stores of commercially sensitive information without requiring widespread ransomware deployment across endpoints.

Vulnerability Details

CVE ID	CVSS Score	Affected Component	Vulnerability Type	EPSS Score
CVE-2026-12569	9.8 (Critical) - CVSS v3.1	PTC Windchill PDMLink / PTC FlexPLM	Remote Code Execution / Deserialization of Untrusted Data	30.20%

CVE-2026-12569 is a critical remote code execution vulnerability affecting PTC Windchill PDMLink and PTC FlexPLM. PTC states that the vulnerability may be exploited through the deserialization of untrusted data.

The vulnerability is associated with CWE-502: Deserialization of Untrusted Data and CWE-20: Improper Input Validation. An attacker capable of reaching a vulnerable deployment can potentially cause attacker-controlled data to be processed by the application and obtain remote code execution without valid authentication.

PTC's CVSS v4.0 assessment assigns the vulnerability a score of 9.3 (Critical). CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities catalog on June 25, 2026 after exploitation was confirmed in the wild.

Attack Methodology

Phase 1: Internet-Facing Windchill and FlexPLM Discovery

The attack begins with identification of externally accessible PTC Windchill or FlexPLM infrastructure. Internet-facing PLM deployments provide attackers with a remotely reachable entry point into systems that may contain large repositories of engineering and corporate information.

Threat intelligence associated with the campaign also describes reconnaissance involving FlexPLM WSDL functionality before exploitation. This enables attackers to gather information about the target environment before proceeding with the Windchill compromise.

Phase 2: Exploitation of CVE-2026-12569

After identifying a vulnerable server, the attacker exploits CVE-2026-12569 to obtain remote code execution. The vulnerability involves unsafe processing of attacker-controlled serialized data, allowing exploitation without legitimate application credentials.

In observed activity, the Windchill remote code execution weakness has been associated with a pre-authentication information-disclosure issue involving the FlexPLM WSDL endpoint. Together, these weaknesses provide attackers with an effective unauthenticated path into exposed systems.

Phase 3: JSP Webshell Deployment

Following successful exploitation, attackers deploy malicious JSP files inside the Windchill web application. A repeatedly observed location is the Windchill login directory:

Windchill Webshell Location

/Windchill/login/

Several observed webshells use randomly generated hexadecimal filenames. Sixteen-character hexadecimal filenames were initially reported, while subsequent activity also included shorter six-character hexadecimal filenames.

Using randomized filenames makes simple filename-based blocking less reliable and allows attackers to deploy new variants without changing the overall intrusion technique.

Phase 4: Persistent Remote Access and Custom Webshell Operations

The deployed webshell provides persistent access through the compromised Windchill application. Rather than functioning only as a basic command shell, reporting on the campaign indicates that Cl0p-linked operators used specialized tooling designed for data discovery, credential access, additional code execution, and large-scale data theft.

The implant can provide a flexible execution environment inside the application process, allowing operators to extend functionality after the initial compromise and maintain a reusable foothold for follow-on operations.

Phase 5: File and Repository Discovery

After establishing access, attackers enumerate files stored within or accessible from the compromised PLM environment. Observed campaign activity includes filesystem enumeration and the creation of file listings such as flst.txt.

This stage allows operators to identify high-value information before transferring it outside the victim environment. Because Windchill commonly manages engineering and product lifecycle information, compromised repositories can expose intellectual property that may be significantly more valuable than conventional endpoint data.

Phase 6: Credential and Application Secret Access

Reporting on Cl0p's custom Windchill implant indicates functionality extending beyond ordinary webshell execution. The tooling can target credentials and application secrets associated with the Windchill environment, potentially providing attackers with additional authenticated access.

Compromise of application credentials increases the risk beyond the original vulnerable server. Credentials recovered from a centralized enterprise application may potentially enable access to connected databases, repositories, services, or other systems if those credentials are reused or trusted elsewhere in the environment.

Phase 7: Data Staging and Exfiltration

Once valuable files are identified, the attackers prepare selected information for theft and transfer it from the compromised environment. Unlike ransomware operations centered on encrypting endpoints, this campaign primarily relies on the confidentiality impact of stolen corporate data.

Reported stolen information includes databases, project files, backups, engineering documents, blueprints, diagrams, images, and other corporate files. Depending on the victim, Cl0p has claimed theft ranging from relatively small collections to multi-terabyte datasets.

Phase 8: Extortion and Public Disclosure

Following data theft, Cl0p contacts affected organizations and demands payment in exchange for withholding the stolen information. Extortion messages associated with the campaign referenced Windchill PDMLink data leakage and were distributed to numerous employees within affected organizations.

Organizations that do not reach an agreement can subsequently be named on Cl0p's data leak infrastructure. In August 2026, the group began publishing full victim names, eventually claiming more than 40 organizations affected through the Windchill campaign.

Indicators of Compromise (IOCs)

Known Webshell Paths

/Windchill/login/7c0a0a34c9d8d53b.jsp
/Windchill/login/46b158b8607a4c00.jsp
/Windchill/login/64652883d9de3299.jsp
/Windchill/login/56c9be44a436c4a2.jsp
/Windchill/login/4b57d0652345d383.jsp
/Windchill/login/ec6ba805a076e709.jsp

Webshell Hunting Patterns

/Windchill/login/[0-9a-f]{16}.jsp
/Windchill/login/[0-9a-f]{6}.jsp
/Windchill/login/dpr_[0-9a-f]{8}.jsp

Malicious Request Header

X-windchill-req

X-windchill-req: ?x8Fmgow

These network indicators should be correlated with Windchill application activity, web logs, file creation events, and historical network telemetry rather than treated as standalone proof of compromise.

File Indicators

Incident-Observed SHA-256

321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1190	Exploit Public-Facing Application	Initial Access
T1505.003	Server Software Component: Web Shell	Persistence
T1083	File and Directory Discovery	Discovery
T1552	Unsecured Credentials	Credential Access
T1105	Ingress Tool Transfer	Command and Control
T1074	Data Staged	Collection
T1213	Data from Information Repositories	Collection
T1657	Financial Theft	Impact

Visual Attack Flow

The attack begins with discovery of an internet-facing PTC Windchill or FlexPLM deployment and exploitation of CVE-2026-12569. Successful exploitation provides remote code execution, after which Cl0p-linked operators deploy persistent JSP webshells, enumerate valuable engineering and corporate information, access application secrets, stage selected files, and exfiltrate data before initiating the extortion process.

Mitigation

Patch affected Windchill and FlexPLM deployments immediately.
Apply the security updates and remediation steps provided by PTC for CVE-2026-12569. Prioritize internet-facing Windchill and FlexPLM environments because active exploitation has been confirmed and the vulnerability is included in CISA's Known Exploited Vulnerabilities catalog.
Hunt for JSP webshells in the Windchill login directory.
Inspect the Windchill web root, particularly the /Windchill/login/ directory, for unexpected JSP files. Search for both known filenames and randomized hexadecimal filenames rather than relying exclusively on published hashes.
Review historical activity dating back to June 2026.
Analyze Windchill access logs, reverse-proxy logs, WAF telemetry, EDR data, authentication logs, firewall records, and outbound network connections for evidence of exploitation and subsequent attacker activity.
Investigate the malicious Windchill request header.
Search available HTTP telemetry for requests containing the observed X-windchill-req header and correlate matches with suspicious requests to the Windchill login directory, unexpected JSP execution, and connections to known campaign infrastructure.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here .

Search across all Learn content