CVE-2026-12569
Known exploited · CISA KEV
EPSS 46% (99th percentile).
CISA federal remediation date Jun 28 · date passed
Vulnerabilities & Exploits · Ransomware
ReliaQuest found Clop-linked attacks using CVE-2026-12569 in PTC Windchill and FlexPLM to drop a bespoke JSP web shell, and SecurityWeek says Clop has now publicly named more than 40 victims. The implant is built for Windchill, not just generic command execution: it can map vault data, decrypt credentials, and load more Java code in memory.
That makes the compromise more than PLM data theft. The shell already knows Windchill’s internal layout, so it can pull working credentials out of the application’s keystore and use them for follow-on access instead of relying on separate stolen passwords or extra tooling.
For manufacturing, transportation, and retail shops running these platforms, the exposure can extend into systems tied to the PLM stack long after the first web shell is removed. If Windchill holds secrets for integrated engineering or identity-linked services, the breach can become a pivot into those downstream systems as well.
4 sources · Aug 19
Known exploited · CISA KEV
EPSS 46% (99th percentile).
CISA federal remediation date Jun 28 · date passed
CyberScoop
The long tail of Clop’s PTC hack is just beginning to emerge
The data theft extortion group likely compromised a critical vulnerability affecting PTC’s product lifecycle management software in June, a month before it sent threatening emails to victims.
originalSecurityWeek
Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign
The cybercrime gang has listed major companies such as Shell, Philips, Fiserv, Zebra, Mindray, and Largan Precision.
originalThe Hacker News
Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
Clop-linked attacks exploit CVE-2026-12569 to deploy a Windchill web shell that decrypts credentials, maps vault data, and loads Java code in memory.
originalPart of the PlainSec briefing for 2026-08-18
Every edition of this story: Clop’s Windchill Backdoor Turns Credentials Loose