CVE-2026-12569 is an unauthenticated RCE in PTC Windchill PDMLink and FlexPLM caused by deserialization of untrusted data. Actors assessed as Cl0p-affiliated have exploited it against internet-exposed instances, deploying JSP web shells and a header-driven implant to enumerate and exfiltrate PLM data.
Key dates:
| Date (2026) | Event |
|---|---|
| Early June | Assessed start of zero-day exploitation |
| 17 June | PTC advisory published, remediation guidance only |
| 18-19 June | Version-specific patches released |
| 25 June | CISA KEV listing, three-day remediation deadline |
| 14 July | Consolidated patch release |
| 20 July | Extortion emails begin |
| 12 August | Cl0p publishes victim names, 40+ claimed |
All indicators below were verified on 27 August 2026.
Vulnerability
| Attribute | Value |
|---|---|
| Products | PTC Windchill PDMLink, PTC FlexPLM |
| Class | Deserialization of untrusted data (CWE-20, CWE-502) |
| CVSS v3.1 (NVD) | 9.8 Critical, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS v4.0 (PTC as CNA) | 9.3 Critical, Automatable: Yes, Provider Urgency: Red |
| Authentication | None |
| User interaction | None |
Both scores appear in public reporting. They are not in conflict: 9.8 is the NVD v3.1 base score, 9.3 is PTC's v4.0 score. Cite the version with the value.
Affected versions. Windchill PDMLink and FlexPLM releases prior to 11.0 M030 through 13.1.3.0. PTC states the advisory also applies to all CPS versions. NVD enumerates discrete builds rather than a range, and the FlexPLM CPE set differs from PDMLink's. Map assets against PTC CS473270 per product line.
Patch status
| Timestamp (ET) | Release |
|---|---|
| 17 Jun, 14:16 | Advisory published. Remediation guidance only, no patch |
| 18 Jun, 10:25 | Windchill 13.0.2 |
| 18 Jun, 17:25 | 12.1.2, 12.0.2 |
| 19 Jun, 13:05 | 11.2.1, 11.1 M020 |
| 19 Jun, 22:30 | 11.0 M030, 13.1.1 |
| 14 Jul, 09:20 | SUPs 13.1.3, 13.1.2 and CPSXB stand-alone patches for 13.1.1, 13.0.2, 12.1.2, 12.0.2, 11.2.1, 11.1 M020, 11.0 M030 |
Systems patched in the 18-19 June window still require the 14 July consolidated release. Reporting that states "patched 17 June" refers to guidance, not patch availability.
PTC has revised CS473270 on 18 June, 8 July, 9 July, 14 July and 27 July. Verify against the current revision.
CISA KEV status
Confirmed against the live KEV feed (catalog version 2026.08.26):
| Field | Value |
|---|---|
| dateAdded | 2026-06-25 |
| dueDate | 2026-06-28 |
| knownRansomwareCampaignUse | Known |
| SSVC | Exploitation: Active, Automatable: Yes, Technical impact: Total |
requiredAction mandates BOD 26-04 compliance, CISA's Forensics Triage Requirements, and discontinuation of the product where mitigation is unavailable. The three-day window is the highest BOD 26-04 risk tier, not an Emergency Directive, and binds only US federal civilian agencies.
This is the first PTC product in the KEV catalog. The ransomware flag is actor-agnostic and names no threat actor.
Attribution
Ransom-ISAC assesses zero-day exploitation from early June 2026, roughly two weeks before disclosure. Subsequent reporting reproduces this assessment rather than establishing it independently.
Supporting: PTC's first advisory entry provided remediation steps before any patch existed. Transient SSH infrastructure was observed on 5.180.41.35 on 11 June, six days pre-disclosure.
Limiting: ReliaQuest, the source of the implant telemetry, states the actor "remains unconfirmed." Ransom-ISAC uses "alleged Cl0p" throughout. CISA names no actor.
Infrastructure reuse. The C2 79.141.160.78 appears in 35 public threat intelligence records dated October 2022 to August 2026, including the CISA/FBI #StopRansomware: CL0P / MOVEit advisory (June 2023) and CLOP RANSOMWARE: DISSECTING NETWORK (November 2025). The same address also appears in April 2026 APT28 and FrostArmada reporting, consistent with shared bulletproof hosting. Corroborating, not conclusive.
Attribution is not a prerequisite for response. Treat any instance internet-reachable after approximately 1 June 2026 as presumed-compromised until hunted. Patching does not remove installed web shells.
Exploitation chain
Web shells
Written to /Windchill/login/. Three naming conventions:
| Generation | Pattern | First seen |
|---|---|---|
| 1 | 16 lowercase hex, .jsp | 18 June 2026 |
| 2 | 6 hex, .jsp, sometimes invoked with ?cmd=whoami or ?cmd=id | 8 July 2026 |
| 3 | dpr_ prefix plus hex, .jsp | 27 July 2026 |
PTC published six generation-1 samples: 7c0a0a34c9d8d53b.jsp, 46b158b8607a4c00.jsp, 64652883d9de3299.jsp, 56c9be44a436c4a2.jsp, 4b57d0652345d383.jsp, ec6ba805a076e709.jsp.
PTC states new shells may be deployed with different names, so filename-based detection is insufficient. Target the path and naming pattern. PTC's advisory is inconsistent on generation 3 (prose says 8 hex, the log-search string says 6), so use dpr_?[0-9a-fA-F]{6,8}\.jsp.
Implant
Driven by request headers, not URL parameters. Commands arrive in X-windchill-req, with parameters in X-windchill-prm. The first byte of the value is a command selector: L lists the document vault, G retrieves a file, and S, D, R, J, O, E perform additional operations.
Match on the header name. The value varies per command and is unusable as a static signature.
| Attribute | Value |
|---|---|
| SHA-256 | 321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf |
| Type / size | ASCII text (JSP), 9,885 bytes |
| First public submission | 2026-07-27 02:52 UTC, 1 submission from 1 source |
| Multi-engine detection | 23 of 75, trojan.java/webshell |
Detection names include Microsoft Backdoor:Java/WebShell!MSR, ESET Java/Webshell.HS, AhnLab-V3 WebShell/JSP.Agent.SC316134. Skyhigh and TrellixENS return Linux/Downloader.fg, a generic misclassification of a JSP text file.
The sample matches two crowdsourced YARA rules from gen_webshells (Neo23x0/signature-base): WEBSHELL_JSP_Generic_Reflection and WEBSHELL_JSP_Generic_Classloader. The matches indicate execution of attacker input via Java reflection and custom classloader invocation, consistent with the CWE-502 entry point.
Reconnaissance
FlexPLM endpoints are fingerprinted before web shell deployment:
method = GET uri_path MATCHES ^/Windchill/rfa/jsp/login/.*\.jsp\?wsdl$ response_bytes = 4045
This fires before compromise, so retrospective searching identifies scanned-but-not-exploited estates and dates first attacker contact. FlexPLM-specific; a PDMLink-only deployment will not generate it.
Artifact
flst.txt in /tmp or the Windchill working directory contains the attacker's file listing. Presence indicates vault enumeration completed.
Correction
Several sources describe a chain pairing CVE-2026-12569 with a separate FlexPLM WSDL pre-authentication information disclosure flaw scored CVSS 7.5. No such vulnerability exists.
The claim originates in a public threat intelligence record (6a65a390a495b81ce223c7c4, 26 July 2026) that is self-identified as an automated generation proof of concept. The same record pulled six unrelated CVE identifiers (CVE-2026-56164, CVE-2026-56155, CVE-2026-50661, CVE-2026-55040, CVE-2026-32201, CVE-2026-45659) from a newsletter aggregation page and lists them as campaign indicators. Ingesting it introduces six false CVE associations.
CVE-2026-12569 is a single-vulnerability RCE. The WSDL activity is reconnaissance.
Indicators of compromise
Verified 27 August 2026.
Network
| IPv4 | ASN (live) | Country | Notes |
|---|---|---|---|
| 79.141.160.78 | AS202015 HZ Hosting | US | C2, MOVEit-era overlap. Priority block |
| 85.9.211.83 | AS202053 UpCloud | FI | Reputation -13, highest in set |
| 5.180.41.35 | AS18978 Enzu | US | PTC-designated primary C2. Priority block |
| 216.152.148.54 | AS63023 GTHost | US | Reputation -2 |
| 206.189.199.39 | AS14061 DigitalOcean | US | Shared cloud |
| 204.194.51.30 | AS140869 Turing Group | US | |
| 64.177.86.200 | AS20473 Constant Company | MX | Shared cloud |
| 64.177.69.57 | AS20473 Constant Company | IL | Shared cloud, also in Australian honeypot feeds |
| 104.243.35.63 | AS23470 ReliableSite | US | |
| 185.227.83.236 | AS199959 Gwy It Pty Ltd | US | |
| 78.128.113.10 | AS209160 Miti 2000 | BG | Reputation -1 |
| 209.222.98.44 | AS23470 ReliableSite | US | |
| 216.152.151.204 | AS63023 GTHost | US | |
| 104.194.9.14 | AS23470 ReliableSite | US | |
| 172.111.38.31 | AS63023 GTHost | US | |
| 104.243.35.131 | AS23470 ReliableSite | US | |
| 74.50.76.146 | AS19318 Interserver | US | Reputation -1 |
| 65.20.79.73 | AS20473 Constant Company | IN | Only APAC-hosted node, shared cloud |
| 81.27.103.18 | AS202053 UpCloud | PL | |
| 212.147.249.110 | AS202053 UpCloud | FI | |
| 38.60.157.212 | AS154177 Light Node | US | |
| 87.58.193.42 | AS135392 MillenialHost | US | |
| 81.27.103.68 | AS202053 UpCloud | PL | |
| 79.141.163.103 | AS202015 HZ Hosting | US | Same AS as priority C2 |
| 66.163.122.78 | AS63023 GTHost | US | |
| 104.243.35.0/24 | AS23470 ReliableSite | US | PTC-published CIDR |
Blocking guidance. Shared cloud addresses 206.189.199.39 (DigitalOcean) and 64.177.69.57, 64.177.86.200, 65.20.79.73 (Vultr) are subject to rapid reassignment, and most reputation sources still rate them benign. Use them for retrospective hunting and time-bounded blocks, not permanent denylist entries. The dedicated C2s 5.180.41.35 and 79.141.160.78 may be blocked indefinitely.
Metadata warning. Published metadata and live enrichment disagree on ASN, country or both for 9 of the 25 addresses. Examples: 185.227.83.236 (QuadraNet/DE vs Gwy It/US), 85.9.211.83 (Windstream/US vs UpCloud/FI), 87.58.193.42 (TDC/DK vs MillenialHost/US). Do not block or attribute by ASN or country for this set.
Files
| Type | Value | Public coverage |
|---|---|---|
| SHA-256 | 321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf | 23 of 75 engines |
| SHA-256 | 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c | None |
| SHA-1 | 05af84bfa569366700d826313cdfde44b5efca48 | None |
| SHA-1 | 8be6f433b443545932821058952916d3c066a8e0 | None |
PTC CS473270 also lists 44 MD5 hashes. None of these resolved to a public sample.
Host and path
| Indicator | Interpretation |
|---|---|
| HTTP POST to /Windchill/login/*.jsp | No legitimate use. Highest-fidelity single indicator |
| [0-9a-f]{16}\.jsp under /Windchill/login/ | Web shell, generation 1 |
| [0-9a-fA-F]{6}\.jsp under /Windchill/login/ | Web shell, generation 2 |
| dpr_?[0-9a-fA-F]{6,8}\.jsp | Web shell, generation 3 |
| Header X-windchill-req or X-windchill-prm | Implant command channel, match name only |
| flst.txt in /tmp or Windchill working directory | Vault enumeration completed |
| GET ^/Windchill/rfa/jsp/login/.*\.jsp\?wsdl$, 4045-byte response | Pre-exploitation reconnaissance |
Remediation
-
Apply the 14 July 2026 consolidated patches. June patching alone is insufficient. Verify against the current CS473270.
-
Treat any instance internet-reachable after approximately 1 June 2026 as presumed-compromised until hunted.
-
Remove Windchill and FlexPLM from direct internet exposure. Front with an authenticated reverse proxy or VPN.
-
Block the indicator set, applying the shared-cloud guidance above. Prioritise 5.180.41.35, 79.141.160.78, 85.9.211.83 and 104.243.35.0/24.
-
Rotate Windchill service account and integration credentials. Review federated supplier and contract manufacturer grants.
Hunting
In order of fidelity:
-
Deploy gen_webshells.yar from Neo23x0/signature-base against Windchill webapp directories. Generic rules, so expect false positives on legitimate JSP. Currently the only signature coverage available.
-
Alert on HTTP POST to /Windchill/login/*.jsp.
-
Search proxy and WAF logs for header names X-windchill-req and X-windchill-prm, any value.
-
Search historical logs for the 4045-byte WSDL response to date first attacker contact.
-
Sweep /Windchill/login/ for the three JSP patterns, comparing against a known-good deployment manifest.
-
Check /tmp and the Windchill working directory for flst.txt.
-
Review outbound volume from the Windchill host and vault storage.
Extortion
Activity began approximately 20 July 2026. Emails carry the subject "Windchill PDMLink module serious data leak", are sent from compromised third-party accounts, and are addressed to large recipient lists within each victim rather than to security functions. Ransom-ISAC assesses the method as consistent with the prior Oracle EBS campaign, differing only in sender addresses.
No victims were listed on the leak site as of 22 July. Full names were published from 12 August, 23 days after the emails began.
Recipients are distributed across non-technical functions, so the common failure mode is delayed escalation. Establish a triage path in advance.
Supply chain exposure
Windchill and FlexPLM hold CAD models, bills of materials, tolerance specifications, supplier agreements, unit costs and pre-release designs. The consequence of loss is intellectual property theft and competitive exposure, with potential export control implications, rather than the breach notification obligations associated with the MOVEit, Cleo and GoAnywhere campaigns.
These deployments commonly federate supplier and contract manufacturer access, so one compromised instance exposes connected upstream and downstream engineering data regardless of who operated the system.
For each partner in an affected supply chain, establish:
-
Whether Windchill or FlexPLM is in use
-
Whether any instance was internet-reachable between June and August 2026
-
Whether the 14 July consolidated patches are applied
-
Whether compromise assessment has been performed, as distinct from patching
Confirmation of patching does not address the presumed-compromise window, so the fourth item cannot be substituted with the third.
Victim reporting
Cl0p began publishing full victim names on 12 August 2026 and claims more than forty organisations. The count and date are attributed to Cl0p's leak site and are not confirmed by the named organisations.
Specific victim identifications circulating in secondary reporting, including Asia-Pacific organisations, could not be substantiated against any source consulted. No threat intelligence platform queried returns victim data. Treat victim identifications as unverified pending confirmation by a named organisation.
References
NVD · CISA KEV · BOD 26-04 · PTC advisory · PTC CS473270 · Ransom-ISAC · ReliaQuest
