{"id":"ptc-windchill-flexplm-attacks-jun-2026","category":"patch","status":"closed","title":"PTC Windchill and FlexPLM CVE-2026-12569 exploited for data theft and extortion; patches available","tldr":"Attackers used CVE-2026-12569 to run code without signing in to PTC Windchill and FlexPLM business servers. Patches are available. Ask IT to apply PTC's version-specific fixes, check for compromise and replace exposed credentials.","summary":"CVE-2026-12569 lets an attacker run code without signing in to vulnerable PTC Windchill PDMLink and FlexPLM servers, which businesses use to manage product designs and manufacturing information. The flaw involves unsafe handling of supplied data. PTC published guidance on 17 June, released patches in stages and announced a broader release on 14 July. CISA listed it as exploited on 25 June. Subsequent reporting described stolen engineering data and extortion; ReliaQuest assessed the connection to Clop as highly likely. Its August analysis also found credential-stealing capabilities, so patching alone does not resolve a suspected compromise. PTC's latest public update reviewed was dated 26 August. As at 3 November, the reviewed sources contain no campaign-wide all-clear. Exact patch identifiers are behind PTC's support login.","action":"Nothing to update on a family's ordinary devices: these are business servers. If your business uses either product, ask IT to apply the current fixes in PTC article CS473270, investigate possible compromise and rotate exposed credentials.","product":"PTC Windchill PDMLink and FlexPLM","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-12569"],"tags":["ptc","windchill","flexplm","remote-code-execution","data-theft","ransomware"],"affected":["Windchill PDMLink: 11.0 M030 and earlier; 11.1 M020; 11.2.1.0; 12.0.2.0; 12.1.2.0; 13.0.2.0; 13.1.0.0; 13.1.1.0; 13.1.2.0; 13.1.3.0. PTC says all CPS versions are covered.","FlexPLM: 11.0 M030 and earlier; 11.1 M020; 11.2.1.0; 12.0.0.0; 12.0.2.0; 12.1.2.0; 12.1.3.0; 13.0.2.0; 13.0.3.0. PTC says all CPS versions are covered."],"fixed":["14 July 2026 security SUPs for 13.1.3 and 13.1.2.","14 July 2026 standalone CPSXB security patches for 13.1.1, 13.0.2, 12.1.2, 12.0.2, 11.2.1, 11.1 M020 and 11.0 M030. These branch numbers require the corresponding patch; exact identifiers are in CS473270."],"matches":[],"sources":[{"kind":"advisory","title":"Customer & Partner Updates: Remote Code Execution Vulnerability in PTC’s Windchill and FlexPLM Solutions","url":"https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability","by":"PTC","date":"2026-08-26"},{"kind":"advisory","title":"CVE-2026-12569: PTC-supplied vulnerability details and CISA catalogue entry","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12569","by":"NVD","date":"2026-06-18"},{"kind":"news","title":"Clop ransomware targets Windchill, FlexPLM in data theft attacks","url":"https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks/","by":"BleepingComputer","date":"2026-07-24"},{"kind":"news","title":"Shell investigates 'potential incident' after Clop data theft claims","url":"https://www.bleepingcomputer.com/news/security/shell-investigates-potential-incident-after-clop-data-theft-claims/","by":"BleepingComputer","date":"2026-08-14"},{"kind":"research","title":"Clop Returns with Custom Implant in Mass-Extortion Campaign","url":"https://reliaquest.com/blog/clop-returns-with-custom-implant-in-mass-extortion-campaign/","by":"ReliaQuest","date":"2026-08-18"}],"started":"2026-06-17","closed":"2026-08-26","created":"2026-11-03T22:07:24.048Z","updated":"2026-11-03T22:07:24.048Z","cve_notes":[{"cve":"CVE-2026-12569","name":"Unauthenticated code execution in Windchill and FlexPLM","what":"Unsafe deserialisation in Windchill PDMLink and FlexPLM lets a remote attacker supply malicious data and run code without signing in.","severity":"critical","cvss":9.3}],"timeline":[{"at":"2026-08-26","added":"2026-11-03T22:00:26.134Z","kind":"vendor-revised","text":"PTC added another compromise indicator and again urged customers to scan their environments.","url":"https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability","by":"PTC","patch":null},{"at":"2026-08-18","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"ReliaQuest described a backdoor that steals stored credentials and maps engineering files after exploitation. It assessed the connection to Clop as highly likely and advised credential rotation where compromise was suspected.","url":"https://reliaquest.com/blog/clop-returns-with-custom-implant-in-mass-extortion-campaign/","by":"ReliaQuest","patch":null},{"at":"2026-08-14","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Shell told BleepingComputer it was investigating a potential incident after Clop claimed to have stolen 89 GB. The report linked the claims to the Windchill/FlexPLM campaign, but Shell did not confirm the entry point or theft.","url":"https://www.bleepingcomputer.com/news/security/shell-investigates-potential-incident-after-clop-data-theft-claims/","by":"BleepingComputer","patch":null},{"at":"2026-07-24","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"BleepingComputer reported data theft and extortion against exposed servers. Ransom-ISAC attributed the campaign to Clop; ReliaQuest's statement at that stage left the attacker unconfirmed.","url":"https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks/","by":"BleepingComputer","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"PTC announced the broader Windchill and FlexPLM patch release: SUPs for 13.1.3 and 13.1.2, and standalone CPSXB patches for seven older branches.","url":"https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability","by":"PTC","patch":"patched"},{"at":"2026-06-25","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-12569 to its catalogue of flaws used in attacks, with a 28 June federal remediation deadline, as recorded by NVD.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12569","by":"NVD","patch":null},{"at":"2026-06-18","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"PTC released patches for Windchill 13.0.2, followed that day by 12.1.2 and 12.0.2. Other branches followed on 19 June.","url":"https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability","by":"PTC","patch":"partial"},{"at":"2026-06-17","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"PTC published immediate remediation guidance for CVE-2026-12569.","url":"https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability","by":"PTC","patch":"none"}],"url":"https://hard.fyi/live/ptc-windchill-flexplm-attacks-jun-2026/","json":"https://hard.fyi/api/live?id=ptc-windchill-flexplm-attacks-jun-2026"}