Clop Exploits Windchill: JSP Web Shell Steals Credentials and Engineering Data

Attack Targets PTC PLM Servers

A campaign highly likely to be attributed to Clop, also known as Cl0p, is exploiting CVE-2026-12569 against PTC Windchill and FlexPLM deployments. The activity was detected on August 19, 2026, and involves the installation of a JSP web shell specifically designed for these products.

This is not a simple shell for executing commands on the server. The component understands Windchill’s internal structure, uses application APIs, queries the database under the identity already assigned to the software, and accesses information stored in the vaults.

The operation may involve the theft of technical data, credential harvesting, lateral movement, and the subsequent deployment of malware or ransomware. The compromise can therefore quickly extend beyond the PLM server itself.

The attribution to Clop is considered highly likely based on an advisory focused on the deployment of JSP web shells on vulnerable systems. The modus operandi is consistent with previous campaigns targeting platforms that store large volumes of corporate data.

CVE-2026-12569: Unauthenticated Remote Code Execution

Initial access exploits CVE-2026-12569, a critical vulnerability that allows arbitrary code execution through a malicious network request.

The technical description identifies two related weaknesses:

• CWE-20, improper input validation;
• CWE-502, deserialization of untrusted data.

NVD assigns the vulnerability a CVSS 9.8 score, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The source analysis instead reports a CVSS 9.3 score. The difference reflects the scoring methodology used, but both scores place the issue in the highest severity category. The attack requires no privileges, user interaction, or special conditions.

According to NVD, the affected products include:

• PTC FlexPLM <= 11.0 M030;
• PTC Windchill PDMlink < 11.0 M030.

The description also states that the issue affects releases prior to 11.0 M030 and may extend to CPS versions. Organizations should therefore verify the exact installed release and compare it with the vendor’s remediation guidance.

The Flaw Is Already Listed in the CISA KEV Catalog

CVE-2026-12569 has been listed in the CISA Known Exploited Vulnerabilities catalog since June 25, 2026. For U.S. federal agencies, the remediation deadline was June 28, 2026.

The catalog also states that the vulnerability has been used in ransomware campaigns. This is therefore not merely a theoretical risk or a laboratory scenario: the exploit has become part of criminal operations involving a structured post-compromise phase.

CISA requires mitigations to be applied according to the vendor’s instructions, in line with BOD 26-04, which focuses on risk-based prioritization of security updates, and with Forensics Triage requirements. The same guidance applies, where relevant, to cloud services. If adequate mitigations are unavailable, CISA recommends discontinuing use of the product.

Over the past 90 days, the catalog has also added CVE-2026-8037, associated with the same vendors listed for PTC, Progress, and Accellion. This places the Windchill incident within a broader pattern of vulnerabilities exploited against products used to manage sensitive corporate data.

A Web Shell Designed to Understand Windchill

The observed JSP component operates directly within the Windchill process. This allows it to use legitimate application functions rather than relying solely on system commands or external tools.

The web shell can:

• enumerate vaults present in the deployment;
• identify repositories containing the most valuable engineering data;
• execute queries using Windchill’s database identity;
• load additional Java code directly into the process memory;
• support data theft, persistence, lateral movement, and encryption.

Additional code is transmitted as a Base64-encoded ZIP archive. A custom class loader loads it into memory and executes the compiled Java bytecode. This allows the attacker to add new capabilities without necessarily installing recognizable tools on the system.

Using the database connections and APIs already employed by the software reduces the distinction between malicious traffic and normal activity. Controls based solely on signatures or searches for suspicious commands may therefore fail to detect the full attack chain.

The “S” Command Decrypts the Keystore and Credentials

The most sensitive function is associated with the single-character “S” command. It can return administrative credentials and accounts used to manage Windchill directories in plaintext by leveraging the internal gs function.

The observed workflow includes reading ieStructProperties.txt, decrypting the LDAP manager’s password stored in the application keystore, and scanning local properties. The shell can also decrypt:

• administrative account credentials;
• object storage credentials;
• site administrator keys;
• other protected values stored in the Windchill environment.

A separate command allows the results to be exfiltrated. By using the application identity and functionality already present in the product, the attacker may avoid creating new attacker-controlled accounts during some stages.

Recovering LDAP credentials significantly increases the risk. The same accounts or integrated directories may control access to Active Directory, email, VPNs, storage, and other corporate services. An incident initially confined to the PLM server can therefore become an enterprise-wide compromise.

Why Windchill Vaults Are High-Value Targets

Windchill and FlexPLM are used to manage product designs, drawings, bills of materials, technical documentation, and other proprietary data. The web shell can locate this content without requiring an extensive manual discovery phase.

Potential impacts include:

• theft of engineering drawings and documentation;
• access to application vaults;
• theft of reusable credentials;
• access to directory-connected systems;
• malware deployment;
• persistence;
• data encryption after exfiltration.

This operational sequence allows the attacker to move from initial access to reconnaissance, credential theft, and data collection while remaining largely within the application’s trust boundary.

Clop Has Used the Same Model Against Other Products

The Windchill case follows previous incidents attributed to Clop involving platforms that concentrate sensitive information.

After exploiting CVE-2021-27101 in Accellion FTA, the group reportedly deployed the DEWMODE web shell. The vulnerability has a CVSS score of 9.8, affects Accellion FTA <= 9_12_370, and was added to the CISA KEV catalog on November 3, 2021, with a remediation deadline of November 17, 2021. The recommended fixed version is FTA_9_12_380 and later releases.

In the case of CVE-2023-34362, Clop reportedly used LEMURLOOT after compromising Progress MOVEit Transfer. The flaw, also rated CVSS 9.8, allows an unauthenticated attacker to exploit SQL injection to access the application database.

CVE-2023-34362 has been listed in the KEV catalog since June 2, 2023, with a remediation deadline of June 23, 2023 for U.S. federal agencies. Affected versions include MOVEit Transfer releases prior to 2021.0.7, as well as the versions listed by NVD: 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1).

Immediate Checks for Windchill Administrators

Organizations should immediately verify the exposed Windchill PDMlink or FlexPLM release and apply the updates or mitigations specified by PTC. If no mitigation is available, temporary decommissioning should be considered, especially when the service is Internet-facing.

The investigation should look for:

• unexpected or recently deployed JSP files;
• anomalous requests to PLM servers;
• access to ieStructProperties.txt;
• unusual keystore reads or decryption activity;
• use of the “S” command or activity associated with the gs function;
• queries executed under the application database identity;
• Base64-encoded ZIP archives;
• Java bytecode loaded into memory;
• vault enumeration and anomalous data transfers.

If signs of compromise are found, LDAP, administrative, and object storage credentials should be treated as exposed and rotated. The investigation should include directories, Active Directory, email, VPNs, storage, and every system accessible with the same accounts.