Cl0p Ransomware Gang Exploits Critical PTC Windchill and FlexPLM Vulnerabilities for Unauthenticated Access

Threat actors linked to the Cl0p ransomware group are actively exploiting critical vulnerabilities in PTC Windchill and FlexPLM to gain unauthenticated remote code execution and steal sensitive engineering data from manufacturing and aerospace sectors.

Key Points:

• Attackers are chaining a pre-authentication information disclosure in FlexPLM with a critical flaw in Windchill to achieve unauthenticated remote code execution.
• The exploited vulnerability, CVE-2026-12569, has a CVSS score of 9.3 and is listed in CISA's Known Exploited Vulnerabilities catalog.
• Targets include high-value sectors such as manufacturing, automotive, aerospace, and retail, with attackers staging and exfiltrating engineering and design data.
• Indicators of compromise include four specific IP addresses shared by PTC and Ransom-ISAC, and attackers are using compromised accounts to send extortion emails.

The Cl0p ransomware group is currently conducting a targeted campaign against organizations using PTC Windchill and FlexPLM software. By exploiting CVE-2026-12569, a critical vulnerability in Windchill with a CVSS score of 9.3, attackers can deploy JSP web shells to execute remote commands without authentication. This is facilitated by a secondary flaw in the FlexPLM WSDL endpoint that allows for pre-authentication information disclosure. The combination of these flaws enables the attackers to bypass security controls entirely.

Learn More: The Hacker News

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)