Cl0p Targets Windchill: More Than 40 Organizations Exposed to a Critical Vulnerability

Ransomware campaign exploits CVE-2026-12569

Cl0p has published the names of more than 40 organizations it claims to have compromised by exploiting CVE-2026-12569, a critical vulnerability in PTC’s Windchill and FlexPLM PLM products.

The group initially released partial names. Starting on August 12, it began publishing the full names of the alleged victims. The activity was identified on August 19, 2026.

However, the claims have not been independently confirmed for the individual organizations. Shell, Philips, Fiserv, and GE said they were aware of the allegations and were investigating, but did not confirm any significant data breach. GE’s name was later removed from Cl0p’s website. It is not known whether the removal was related to a ransom payment or renewed negotiations.

The listed organizations also include Zebra Technologies, Ingersoll Rand, Toast, Mindray, and Largan Precision, a supplier of camera lenses for Apple.

Unauthenticated RCE with a CVSS score of 9.8

CVE-2026-12569 allows a remote, unauthenticated attacker to execute arbitrary code by sending specially crafted requests to a vulnerable system.

The flaw involves the deserialization of untrusted data and input-validation issues. The NVD associates the vulnerability with:

• CWE-20, improper input validation;
• CWE-502, deserialization of untrusted data.

The CVSS v3 score is 9.8, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In practice, the attack can be carried out over the network, with low complexity, without credentials, and without any user interaction. The potential impact affects the confidentiality, integrity, and availability of systems.

The affected versions are:

• PTC FlexPLM <= 11.0 M030;
• PTC Windchill PDMLink < 11.0 M030.

The advisory also states that the issue affects all CPS versions and Windchill and FlexPLM releases prior to 11.0 M030. Organizations should therefore verify the exact release, CPS, and installed configuration rather than relying solely on the primary version number.

From compromise to web shell

The exploitation observed in Cl0p ransomware activity has also been analyzed by ReliaQuest. According to its analysis, affiliates install web shells on compromised Windchill systems and use them as persistent access points.

The identified tooling includes a custom component capable of:

• locating sensitive data stored in vaults;
• decrypting credentials held in the Windchill keystore;
• embedding a Java class loader;
• executing additional code within the application process;
• facilitating lateral movement, persistence, and ransomware deployment.

This approach reduces reliance on external tools and directly leverages the application context of the compromised system. Access to the Windchill process can therefore provide attackers with a privileged position from which to reach repositories, credentials, and design data.

For each victim, Cl0p has indicated the type and volume of data it claims to have exfiltrated. The list includes databases, project files, backups, photographs, images, engineering documentation, blueprints, diagrams, logs, and corporate documents.

The claimed volumes range from 1 GB to several terabytes per organization. The data may include intellectual property and sensitive personal information. However, not all of the data would necessarily have the same value: some of it may already be public or have limited utility. This could explain why some organizations allegedly refused to pay the ransom, although the claim cannot be verified in every case.

A vulnerability already under active exploitation

CVE-2026-12569 was disclosed in June, when CISA added it to the Known Exploited Vulnerabilities (KEV) catalog and PTC reported ongoing attacks.

The vulnerability was added to the catalog on 2026-06-25. For U.S. federal agencies, the remediation deadline was 2026-06-28.

The NVD also classifies the flaw as being used in ransomware campaigns. The cybersecurity industry observed Cl0p-associated exploitation in late July. CVE-2026-12569 has been described as the first Windchill vulnerability exploited in the wild.

The incident is part of Cl0p’s established strategy of targeting enterprise platforms. The group has previously conducted data-theft and double-extortion campaigns by exploiting vulnerabilities in Oracle E-Business Suite, MOVEit, Cleo, and GoAnywhere.

The operating model is consistent: compromise a central application, steal large volumes of data, and gradually publish victims’ names to increase pressure. German organizations were also reportedly warned by police about the possibility of imminent attacks.

What organizations using Windchill should do

The first step is to apply the update or mitigation provided by PTC and bring Windchill and FlexPLM to at least the non-vulnerable releases specified in the advisory, while also checking all installed CPS versions.

Priority should be given to Internet-exposed environments. If an update cannot be applied immediately, the organization should implement the vendor’s mitigations, reduce service exposure, and consider temporarily isolating the product. CISA recommends discontinuing its use when mitigations are unavailable.

Monitoring should focus on:

• new or modified web shells;
• unusual Java class loading;
• abnormal code execution within the application process;
• irregular access to vaults and keystores;
• suspicious authentication activity and lateral movement;
• unusual reads or transfers involving databases, backups, and technical files.

Potentially exposed credentials must be rotated, including those stored in the keystore. If indicators of compromise are present, organizations should preserve logs, system images, and other evidence useful for analysis, avoiding deletion of the web shell before evidence has been collected.

CISA also requires organizations to follow the applicable instructions in BOD 26-04 — Prioritizing Security Updates Based on Risk and the Forensics Triage requirements. For cloud services, the guidance applicable to that environment should be followed.

It is not known whether all named organizations suffered an actual breach or how much data was genuinely exfiltrated. For organizations running vulnerable versions, however, the vulnerability’s inclusion in the KEV catalog and the observed ransomware campaigns make patching an urgent response—not merely a preventive task.