PTC Windchill Vulnerability Exploited in Ransomware Campaign

A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-12569 with a CVSS score of 9.3, exists within PTC’s Windchill and FlexPLM product lifecycle management (PLM) platforms. This vulnerability stems from a deserialization of untrusted data issue, allowing attackers to execute code without requiring authentication. PTC released patches on June 17th, but the vulnerability was immediately exploited in the wild the following day, prompting the publication of indicators of compromise (IoCs).

ReliaQuest and Ransom-ISAC, in collaboration with eCrime.ch and Defused, have issued warnings highlighting the ongoing exploitation by a Cl0p affiliate. The attackers are chaining a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet to achieve RCE and deploy JSP webshells. Following initial access, the hackers have been observed enumerating filesystems, staging data, and exfiltrating data for extortion purposes.

Starting July 20th, the attackers have been targeting organizations across the aerospace, automotive, manufacturing, and retail/apparel sectors. They are sending extortion emails with a subject line “Windchill PDMLink module serious data leak” to hundreds of users within the impacted organizations. As of July 22nd, Cl0p ransomware has not yet listed victims on their dark web data leak site or claimed responsibility for this campaign.

Organizations are strongly advised to apply PTC’s patches and utilize previously published and newly shared IoCs to conduct threat hunting. Following PTC’s recommended remediation steps is also crucial.