Cl0p uses PTC Windchill CVE-2026-12569 against 43 majors: Shell/GE/Philips, 89GB of engineering drawings leaked
Cl0p added 43 victim orgs to its dark-web leak portal, including Shell, GE, and Philips, claiming ~89GB of engineering drawings and facility test reports. The campaign exploits insecure deserialization in PTC Windchill/FlexPLM, CVE-2026-12569 (CVSS 9.8). CISA added it to the Known Exploited Vulnerabilities catalog.
Incident overview
CVE-2026-12569 is a critical RCE in PTC's Windchill PDMLink and FlexPLM product lifecycle management (PLM) platforms. Cl0p weaponized it for mass data theft against 43 global enterprises including Shell, GE, and Philips. The bug is insecure deserialization of untrusted data; an unauthenticated attacker can execute code on the application server. PTC started shipping patches on 17 June, warned customers of elevated threat activity on 26 June. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog and required federal agencies to patch within three days. Germany's BSI issued an overnight emergency notice to PTC customers.
Cl0p's new wave of 43 victims
From 14 August, Cl0p listed the 43 enterprises as new victims on its dark-web leak portal and claimed theft of engineering drawings, scanned facility test reports, facility photos, project roadmaps, backups, system files, databases, CAD files, schematics, and product blueprints. In the Shell case the group claimed ~89GB. Engineering and PLM content described across cases consistently matches typical Windchill/FlexPLM holdings. ReliaQuest and Ransom-ISAC independently confirmed attackers planted JSP webshells under the Windchill login directory for persistent command execution.
Technical details
CVE-2026-12569 is insecure deserialization: the PTC platform does not adequately filter externally supplied Java objects. Attackers craft a gadget chain so deserialization in the app-server process triggers arbitrary class load and method invocation, then OS command execution. ReliaQuest's public kill chain: deliver a deserialization payload via the affected instance's web interface; on success, write a hex-named JSP webshell under `/Windchill/login/`; use custom HTTP header `X-windchill-req` and `flst.txt` artifacts for file enumeration and data theft.
Impact
PTC discloses 30,000+ global Windchill and FlexPLM customers; FlexPLM serves 1,500+ large brand and retail enterprises. The PLM typically holds the product-structure system of record for engineering, manufacturing, quality, and supply-chain teams, including sensitive material shared with suppliers and partners. A single RCE therefore does not just break the app—it creates supply-chain risk through integrated BOM, CAD, and test-report data. The 89GB in the Shell case (engineering drawings, facility photos, project roadmaps) is secondary intel risk against energy infrastructure.
Detection and remediation
- Upgrade immediately to PTC's latest Windchill/FlexPLM patched builds (all patches since 17 June). Cover engineering-team and subsidiary-owned instances.
- Converge access on every internet-reachable Windchill/FlexPLM instance. Put them behind VPN or a trusted access gateway if needed.
- Hunt unexpected JSP files under `/Windchill/login/`, `flst.txt`, requests with `X-windchill-req`, and anomalous POST patterns. Back-check logs from June 2026.
- Isolate confirmed-compromised servers. Preserve forensic images, then rotate all credentials, API keys, Service Accounts, and third-party integration keys.
- In SIEM/EDR, detect anomalous child-process spawn from Windchill, JSP webshell drop, and unexpected outbound connections.
Sources
- BleepingComputer: Shell investigates potential incident after Clop data theft claims
- Foresiet: Cl0p Targets PTC Windchill FlexPLM (CVE-2026-12569)
- CISA Known Exploited Vulnerabilities Catalog