The Cl0p ransomware group has named more than 40 organizations allegedly targeted in the recent campaign that exploited a vulnerability in PTC’s product lifecycle management (PLM) platforms Windchill and FlexPLM.
The vulnerability and its exploitation
The exploitation of the vulnerability, tracked as CVE-2026-12569, came to light in June, when CISA added it to its KEV catalog and the vendor warned of attacks targeting it.
The flaw is an improper input validation issue that allows a remote, unauthenticated attacker to achieve arbitrary code execution via specially crafted requests.
Exploitation of the vulnerability was expected, with police in Germany reportedly alerting organizations about imminent attacks.
It’s worth noting that CVE-2026-12569 is the first ever Windchill vulnerability to be exploited in the wild.
The cybersecurity industry reported seeing exploitation of the PLM product flaw in Cl0p ransomware attacks in late July. Cl0p affiliates exploited the security hole to deliver web shells that gave them access to the data of organizations using Windchill.
Security firm ReliaQuest reported on Tuesday that Cl0p has been using a custom implant designed to provide “full data theft capability” without requiring additional tools.