CVE-2026-12569: Clop Exploits PTC Windchill Deserialization RCE to Drop WebShells, Steal Data

Clop is actively exploiting critical deserialization CVE-2026-12569 (CVSS 9.3) in PTC Windchill and FlexPLM to drop JSP WebShells and steal product data. CISA added it to KEV.

Incident Overview

June–July 2026: Clop ransomware confirmed actively exploiting CVE-2026-12569 in PTC Windchill PDMlink and FlexPLM PLM platforms for large-scale data theft. Insecure deserialization. CVSS 9.3 (Critical). Unauthenticated RCE on affected PLM systems.

Ransomware Information Sharing and Analysis Centre (Ransom-ISAC) and ReliaQuest report Clop drops JSP WebShells for persistence, steals sensitive product data, then sends hundreds of ransom emails from previously compromised mailboxes. CISA added the CVE to the Known Exploited Vulnerabilities (KEV) catalog late June.

Technical Details

Vulnerability

| Field | Value | | --- | --- | | CVE | CVE-2026-12569 | | CVSS 4.0 | 9.3 (Critical) | | CVSS 3.1 | 9.8 (Critical) | | Type | CWE-502: Deserialization of Untrusted Data / CWE-20: Improper Input Validation | | Attack vector | Network, unauthenticated, no user interaction | | Affected products | PTC Windchill PDMlink, PTC FlexPLM and all CPS versions |

Affected versions

• Windchill / FlexPLM 11.0 M030 and earlier
• Windchill 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0
• Windchill 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0
• FlexPLM 12.0.0.0, 12.0.2.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0

Attack chain

Per PTC advisory and CIRT Jamaica IOCs:

• Initial access: scan internet-exposed Windchill/FlexPLM instances
• Exploit: deserialize untrusted data; execute attacker code on the server
• WebShell: drop 16-hex-named JSP under /Windchill/login/ (e.g. 7c0a0a34c9d8d53b.jsp)
• Data theft: enumerate filesystem via WebShell; extract product designs, BOMs, trade secrets
• Extortion: ransom emails from compromised mailboxes to employees

IOCs

• C2 IP: 5.180.41.35
• WebShell path: /Windchill/login/[16-hex].jsp
• Malicious header: X-windchill-req: (first character is command selector)
• File IOC: flst.txt (in /tmp or Windchill working directory)
• WebShell SHA256: 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c

Impact

PTC Windchill and FlexPLM are widely used PLM platforms in manufacturing: aerospace, automotive, electronics, medical devices. Successful exploit of CVE-2026-12569 enables:

• Full PLM server control; root/System
• Theft of core design drawings, BOMs, process routes, supply-chain data
• Tampering of design files; downstream physical safety risk
• Pivot from PLM into the rest of the enterprise network
• Secondary extortion against suppliers and customers

Remediation

Official patches

PTC released patches. Apply via eSupport CS473270 immediately:

• Windchill 13.0.2 patch available
• FlexPLM matching-version patches released in parallel
• Prefer upgrade to latest 13.1.x patched release

Temporary mitigations

• Block 5.180.41.35 at the perimeter firewall
• Remove internet exposure of Windchill login ports; VPN or trusted nets only
• WAF/IDS: drop all traffic with X-windchill-req header
• Hunt HTTP logs for POST to /Windchill/login/*.jsp
• Inspect .../Windchill/codebase/login/ for 16-hex-named .jsp files
• Search /tmp and Windchill working dirs for flst.txt

Detection

// SIEM log query: detect WebShell deploy
method = "POST" AND uri_path MATCHES "^/Windchill/login/[0-9a-f]{16}\.jsp$"

// WAF/IDS rule: drop C2 command header
request.headers contains "X-windchill-req" → DROP + ALERT

// File integrity monitoring
path /codebase/login/*.jsp sha256: 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c

References

• PTC official advisory: Windchill/FlexPLM RCE
• NVD: CVE-2026-12569
• CISA Known Exploited Vulnerabilities catalog
• CIRT Jamaica: Clop ransomware PTC Windchill exploitation advisory