Cl0p Ransomware Exploits PTC Windchill CVE-2026-12569: Shell, Philips, GE Among 43 Named Victims

Campaign overview

The Cl0p extortion group spent August 2026 naming Shell, Philips, General Electric, Fiserv, and dozens of other companies on its dark web leak site. The common thread is not a shared file transfer vendor but a shared product lifecycle management vendor: PTC's Windchill and FlexPLM software, which aerospace, automotive, and manufacturing firms use to store CAD files, blueprints, and supply chain data.

The vulnerability behind the campaign, CVE-2026-12569, carries a CVSS score between 9.3 and 9.8 depending on the advisory. It is a deserialization-of-untrusted-data flaw in PTC Windchill PDMLink and FlexPLM that allows unauthenticated remote code execution. According to threat intelligence firm Ransom-ISAC, Cl0p affiliates most likely began exploiting the flaw as an undisclosed zero-day in early June 2026.

Exploit chain and technical details

A coordinated advisory from Ransom-ISAC, eCrime.ch, and DEFUSED described a two-step exploit chain. Attackers first abuse a pre-authentication information-disclosure bug in FlexPLM, then chain it with the Windchill RCE to gain full server control. No valid credentials are required to start the attack, so any unpatched Windchill or FlexPLM instance exposed to the public internet was a viable target.

Once on the server, Cl0p affiliates dropped JSP web shells to browse the file system, locate engineering and design data, and stage it for exfiltration. Threat intelligence vendor ReliaQuest analyzed a custom JSP web shell it assessed as highly likely linked to Cl0p. According to ReliaQuest, the shell maps sensitive vault data, decrypts every credential in the Windchill keystore, and includes a custom Java class loader that can run additional code inside the application process.

PTC disclosed the flaw on June 17, 2026 (advisory CS473270) and, according to Censys, began releasing fixed builds for affected versions on June 18. The advisory applies to all CPS versions, and the flaw also affects Windchill and FlexPLM releases prior to 11.0 M030. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on June 25, 2026. Ransom-ISAC rates the FlexPLM WSDL information disclosure used in the chain at CVSS 7.5 and reports that PTC has released fixed builds for both defects.

Timeline

Patching did not end the campaign. According to Ransom-ISAC, organizations began receiving Cl0p extortion emails on July 20 with the subject line "Windchill PDMLink module serious data leak," sent from compromised accounts to hundreds of users per victim. On July 22, Ransom-ISAC published an advisory warning that Cl0p affiliates were actively exploiting unpatched, internet-exposed Windchill and FlexPLM servers. The campaign went public in mid-August, when Cl0p posted Shell, Philips, GE, Fiserv, and others in a batch of 43 new leak site victims.

1. 1.
   Early June 2026: Cl0p affiliates begin exploiting CVE-2026-12569 as an undisclosed zero-day.
2. 2.
   June 17, 2026: PTC discloses CVE-2026-12569 in advisory CS473270; fixed builds follow from June 18.
3. 3.
   June 25, 2026: CVE-2026-12569 added to CISA KEV catalog.
4. 4.
   July 20, 2026: Victim organizations begin receiving Cl0p extortion emails, according to Ransom-ISAC.
5. 5.
   July 22, 2026: Ransom-ISAC warns that exploitation of unpatched, internet-exposed servers is continuing.
6. 6.
   Mid-August 2026: Cl0p posts Shell, Philips, GE, Fiserv, and other names on its leak site in a batch of 43 new victims.

Victim profile and stolen data

The claimed data is engineering intellectual property rather than consumer records. Cl0p claims it took approximately 89 GB of data from Shell, described in coverage as engineering drawings, facility testing reports, photos of facilities, and project plans. Shell said it was aware of a potential incident and was investigating. Cl0p's listing for Philips claims drawings, diagrams, and blueprints; Philips said it identified and contained an attempted compromise of a specific enterprise server and that customer environments were not affected. No production systems were reported as encrypted.

General Electric and Fiserv round out the highest profile names claimed by Cl0p. GE appeared briefly on the leak site before the listing disappeared; GE said it was aware of the claim and was assessing the potential issue. Fiserv said that, based on its review to date, it had found no evidence that customer, banking, transaction, or personal data had been compromised, or that its operating environment had been affected.

None of the named companies has confirmed a significant data breach, according to SecurityWeek. ZeroFox describes the campaign as a shift away from the personal and financial records targeted in earlier Cl0p campaigns; the MOVEit campaign alone affected more than 77 million individuals. The other organizations named on Cl0p's leak site span aerospace, automotive, apparel, and manufacturing.

Comparison to prior Cl0p campaigns

Cl0p has run this playbook before. Each time, the group exploits a vulnerability in a widely deployed enterprise software product to steal data from many organizations at once.

Measured by victim count, the Windchill and FlexPLM campaign sits closer to the GoAnywhere and Cleo scale than to MOVEit's thousands. What sets it apart is the target category. MOVEit, GoAnywhere, and Cleo are file transfer tools that happened to hold whatever data passed through them. Windchill and FlexPLM are purpose-built repositories for product designs and engineering intellectual property.

Defensive actions

Organizations running PTC Windchill or FlexPLM should apply the fixed builds listed in PTC advisory CS473270 to every Windchill PDMLink, FlexPLM, and CPS instance. Internet-exposed instances should be moved behind a VPN or restricted to internal network access. Because the exploit chain does not require valid credentials, any instance that was reachable from the public internet before it was patched should be treated as potentially compromised and examined for JSP web shells, unauthorized credential access, and data exfiltration artifacts.

The CISA KEV listing for CVE-2026-12569 carries a federal remediation deadline. Private sector organizations should apply the same urgency. Exploitation continued for weeks after the patch shipped, as the July extortion emails and Ransom-ISAC's July 22 advisory show.