Cl0p Exploits PTC Windchill Zero-Day to Steal Engineering Secrets Worldwide

Unauthenticated RCE in PTC Windchill — CVE-2026-12569

Cl0p ransomware affiliates are exploiting a critical zero-day in PTC Windchill and FlexPLM to gain unauthenticated remote code execution, deploy JSP webshells, and exfiltrate sensitive engineering data for double-extortion. The vulnerability, CVE-2026-12569, carries a CVSS v3.1 score of 9.8 and affects Windchill PDMLink and FlexPLM releases before version 11.0 M030.

PTC disclosed the flaw on June 17, 2026. CISA added it to the Known Exploited Vulnerabilities catalog on June 25. By then, Cl0p affiliates had already been weaponizing it as a zero-day for weeks — the campaign traces back to early June, according to analysts at Ransom-ISAC working with DEFUSED and CyberPress.

The Attack Chain: Two Flaws, No Credentials Needed

The exploitation doesn't require a single vulnerability — it chains two separate flaws to achieve reliable unauthenticated access:

1. FlexPLM WSDL information disclosure (CVSS 7.5) — The attack begins with pre-authentication information leakage through the FlexPLM WSDL endpoint. Reconnaissance patterns include GET requests to /Windchill/rfa/jsp/login/*.jsp?wsdl returning response sizes of 4045 bytes.

2. Windchill login servlet deserialization (CVE-2026-12569, CVSS 9.8) — The chained flaw exploits unsafe deserialization of untrusted data in web-exposed components, allowing remote, unauthenticated attackers to execute arbitrary code via crafted requests.

Once the chain succeeds, attackers deploy hex-named JSP webshells into the /Windchill/login/ path, matching the pattern [0-9a-f]{16}.jsp. The operators then inspect server files, stage engineering data, and prepare for large-scale exfiltration.

Who's Behind It: Cl0p's Multi-Name Operation

The campaign is linked to Cl0p affiliates, an operation tracked under multiple names across the threat intelligence community: Graceful Spider, Chubby Scorpius, FIN11, and Lace Tempest. Ransom-ISAC shared the findings with CyberSecurity News, noting that intrusions date back to early June 2026, followed by mass extortion emails sent through randomly compromised accounts.

The extortion messages force organizations to investigate possible theft quickly while protecting employees from follow-on phishing and social-engineering attempts. Cl0p uses a double-extortion model, pressuring victims with stolen data even when systems can be recovered from backups.

What's at Stake: Engineering IP and Product Designs

PTC Windchill is a product lifecycle management (PLM) platform used by manufacturers, automotive firms, aerospace organizations, and retail apparel companies to manage engineering data, BOMs, CAD files, and supply-chain configurations. A successful compromise gives attackers access to an organization's most valuable intellectual property — the designs and specifications that define their products.

Post-compromise activity includes filesystem enumeration via an flst.txt file listing, staging of engineering and design repositories, and preparation for large-scale data theft. The targeted sectors — manufacturing, automotive, aerospace, and retail/apparel — represent some of the most IP-intensive industries in the global economy.

Indicators of Compromise

Organizations running PTC Windchill or FlexPLM should hunt for these IOCs identified by researchers:

• Malicious HTTP header: X-windchill-req: ?x8Fmgow

• Webshell paths: /Windchill/login/[0-9a-f]{16}.jsp

• Known webshell hash (SHA-256): 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c

• C2 infrastructure: 203.0.113.2, 203.0.113.3, 203.0.113.4, 203.0.113.5

• Recon pattern: GET requests to /Windchill/rfa/jsp/login/*.jsp?wsdl with 4045-byte responses

How to Protect Yourself

• Patch immediately: Upgrade to PTC Windchill 11.0 M030 or later. If patching isn't possible, restrict network access to Windchill instances behind a VPN or firewall.

• Hunt for webshells: Search the /Windchill/login/ directory for hex-named JSP files matching [0-9a-f]{16}.jsp. Cross-reference with the SHA-256 hash above.

• Block IOCs: Add the four C2 IPs (203.0.113.2–5) to your firewall blocklist. Monitor for the X-windchill-req header in web server logs.

• Audit internet exposure: Any Windchill or FlexPLM instance reachable from the public internet is a target. Review your attack surface immediately.

• Monitor for extortion emails: Cl0p sends mass extortion messages to employees after exfiltration. Train staff to report — and not respond to — these messages.

CVE-2026-12569 is the latest in Cl0p's pattern of exploiting file-transfer and PLM platforms for maximum data theft. The group previously exploited MOVEit Transfer, GoAnywhere MFG, and Accellion FTA. PTC Windchill joins that list — and with CVSS 9.8 and no authentication required, it's one of the most dangerous entries yet.