Threat actors linked to the Clop (Cl0p) ransomware gang are actively exploiting CVE-2026-12569, a critical unsafe deserialization vulnerability rated CVSS 9.3, against Internet-exposed PTC Windchill and FlexPLM Product Lifecycle Management (PLM) instances. According to security firm ReliaQuest, exploitation delivers unauthenticated remote code execution and drops JSP webshells that attackers use to pull sensitive product data out of compromised enterprises. PTC began shipping fixes on June 17, and both CISA and Germany's Federal Office for Information Security (BSI) have since pushed customers toward urgent remediation as Clop's extortion machine shifts to a new target class.

Clop widens its data-theft targeting to PLM platforms

PTC Windchill and PTC FlexPLM belong to the Product Lifecycle Management (PLM) software category, used to track, design, and manage products from initial concept through final manufacturing. They are widely deployed by engineering, manufacturing, quality, and supply chain teams across aerospace, defense, automotive, heavy machinery, retail, and medtech companies. PTC reports more than 30,000 customers worldwide, including over 1,500 brand and retail customers on FlexPLM.

The campaign fits Clop's established playbook of breaching enterprise platforms purely for data theft. Previous victims included Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, and Cleo file-sharing products, as well as MOVEit Transfer — which affected more than 2,770 organizations globally. Most recently, the group exploited an Oracle EBS zero-day since early August 2025 to steal files from organizations including Harvard University, The Washington Post, GlobalLogic, the University of Pennsylvania, Logitech, Estée Lauder, Korean Air, and American Airlines subsidiary Envoy Air.

The vulnerability

CVE-2026-12569 is described in the NVD entry as a critical remote code execution (RCE) vulnerability in PTC Windchill PDMlink and PTC FlexPLM, exploitable through the deserialization of untrusted data. The GitHub Security Advisory (GHSA-F345-WXWR-FXFH) notes the issue also affects Windchill and FlexPLM releases prior to 11.0 M030 and extends to all CPS versions, pointing to PTC support article CS473270 and the CISA KEV catalog listing. ReliaQuest's alert describes it as a critical improper input validation flaw permitting arbitrary code execution on vulnerable instances.

How the attack works

ReliaQuest reported on Thursday that it observed threat actors actively exploiting the flaw:

"ReliaQuest has observed threat actors actively exploiting CVE-2026-12569, a critical unsafe deserialization vulnerability (CVSS 9.3) affecting PTC Windchill and FlexPLM. Exploitation enables unauthenticated remote code execution and JSP web shell deployment for remote command execution and sensitive product data exfiltration."

In short, an attacker who can reach an unpatched, Internet-exposed instance can trigger remote code execution without credentials. The operators then plant JSP webshells on the compromised PLM platforms, which provide ongoing remote command execution and serve as the channel for exfiltrating sensitive product data. ReliaQuest notes that the specific actor behind these attacks is not yet confirmed, but the observed tradecraft shares characteristics with earlier Cl0p campaigns aimed at enterprise applications and high-value data repositories.

Extortion emails from hijacked mailboxes

The attacks were independently confirmed by the Ransomware Information Sharing and Analysis Centre (Ransom-ISAC), a nonprofit focused on ransomware tracking and defense. Brandon Parsons of Ascent Solutions told BleepingComputer that Clop appears to be sending extortion messages through previously compromised email accounts to multiple employees of targeted organizations:

"The extortion emails appear to originate from randomly compromised accounts, are sent to hundreds of users within an impacted organization and include Cl0p's latest contact information."

Parsons said the approach matches the Oracle EBS campaign from last year, apart from the use of new email addresses. Rotating email addresses before launching a fresh extortion wave is a recurring tactic for the group.

Patch timeline and government response

PTC started releasing security patches for CVE-2026-12569 on June 17. Although the company did not confirm in-the-wild exploitation at the time, it distributed remediation guidance in a private advisory and urged customers to review their environments for indicators of compromise (IOCs). On June 26, PTC warned customers of "heightened threat activity," and the Cybersecurity and Infrastructure Security Agency (CISA) subsequently added the vulnerability to its Known Exploited Vulnerabilities catalog, ordering U.S. federal agencies to secure their PTC Windchill and FlexPLM instances within three days.

German authorities responded with similar urgency. As reported by Heise, the BSI emailed and telephoned PTC customers in the middle of the night, telling them to patch as quickly as possible. The same pattern of emergency action occurred in March, after reports surfaced that a similar critical Windchill and FlexPLM flaw, CVE-2026-4681, was already being exploited or likely to be exploited soon.

Technical background

CVE-2026-12569 belongs to a well-known class of weakness: unsafe deserialization in Java-based enterprise applications. Windchill and FlexPLM run as Java web applications, typically deployed on Apache Tomcat. When an application passes untrusted, attacker-controlled bytes to a deserialization routine such as ObjectInputStream.readObject(), a crafted serialized payload can instantiate objects that trigger unintended behavior — "gadget chains" that execute system commands during the deserialization process itself. When such an endpoint sits on an unauthenticated path, the result is pre-auth RCE.

A common post-exploitation pattern for this class of flaw is dropping a JSP webshell into the web application root, then invoking it over HTTP to run arbitrary operating-system commands. The commands below are generic illustrations for this class of issue and are not taken from the observed campaign:


# Illustrative: probe whether a deserialization endpoint is reachable
curl -k -X POST 'https://plm.example.com/servlet/Deserialize' \
  -H 'Content-Type: application/x-java-serialized-object' \
  --data-binary @gadget.bin

# Illustrative: locate freshly dropped JSP files in the web root
find /opt/tomcat/webapps -name '*.jsp' -mtime -30 -ls

# Illustrative: surface HTTP requests that invoked JSP files
grep -E '\.jsp' /opt/tomcat/logs/localhost_access_log.* | tail -n 50

Detection and mitigation

ReliaQuest advises PTC customers to patch Windchill and FlexPLM systems and, where possible, place them behind VPNs or trusted access gateways. If compromise is suspected, the guidance is to isolate the affected servers, collect forensic artifacts, and rotate any exposed credentials before restoring service. PTC's private advisory likewise urged customers to review their environments for IOCs.

Organizations that do not pay the demanded ransom can expect the stolen documents to be published on Clop's dark web leak site, where the data is made available for download via Torrent. The U.S. Department of State now offers a $10 million reward for information that could tie the gang's attacks to a foreign government.

References