PTC Windchill and FlexPLM CVE-2026-12569 exploited for data theft and extortion; patches available
Attackers used CVE-2026-12569 to run code without signing in to PTC Windchill and FlexPLM business servers. Patches are available. Ask IT to apply PTC's version-specific fixes, check for compromise and replace exposed credentials.
Nothing to update on a family's ordinary devices: these are business servers. If your business uses either product, ask IT to apply the current fixes in PTC article CS473270, investigate possible compromise and rotate exposed credentials.
What’s happening
CVE-2026-12569 lets an attacker run code without signing in to vulnerable PTC Windchill PDMLink and FlexPLM servers, which businesses use to manage product designs and manufacturing information. The flaw involves unsafe handling of supplied data. PTC published guidance on 17 June, released patches in stages and announced a broader release on 14 July. CISA listed it as exploited on 25 June. Subsequent reporting described stolen engineering data and extortion; ReliaQuest assessed the connection to Clop as highly likely. Its August analysis also found credential-stealing capabilities, so patching alone does not resolve a suspected compromise. PTC's latest public update reviewed was dated 26 August. As at 3 November, the reviewed sources contain no campaign-wide all-clear. Exact patch identifiers are behind PTC's support login.
- What
- Flaw
- Affects
- PTC Windchill PDMLink and FlexPLM
- Affected
- Windchill PDMLink: 11.0 M030 and earlier; 11.1 M020; 11.2.1.0; 12.0.2.0; 12.1.2.0; 13.0.2.0; 13.1.0.0; 13.1.1.0; 13.1.2.0; 13.1.3.0. PTC says all CPS versions are covered.
FlexPLM: 11.0 M030 and earlier; 11.1 M020; 11.2.1.0; 12.0.0.0; 12.0.2.0; 12.1.2.0; 12.1.3.0; 13.0.2.0; 13.0.3.0. PTC says all CPS versions are covered. - Fixed in
- 14 July 2026 security SUPs for 13.1.3 and 13.1.2.
14 July 2026 standalone CPSXB security patches for 13.1.1, 13.0.2, 12.1.2, 12.0.2, 11.2.1, 11.1 M020 and 11.0 M030. These branch numbers require the corresponding patch; exact identifiers are in CS473270. - Since
- 17 June 2026
- Closed
- 26 Aug 2026
Timeline
- Vendor revised
PTC added another compromise indicator and again urged customers to scan their environments.
- Wider attacks
ReliaQuest described a backdoor that steals stored credentials and maps engineering files after exploitation. It assessed the connection to Clop as highly likely and advised credential rotation where compromise was suspected.
- Update
Shell told BleepingComputer it was investigating a potential incident after Clop claimed to have stolen 89 GB. The report linked the claims to the Windchill/FlexPLM campaign, but Shell did not confirm the entry point or theft.
- Wider attacks
BleepingComputer reported data theft and extortion against exposed servers. Ransom-ISAC attributed the campaign to Clop; ReliaQuest's statement at that stage left the attacker unconfirmed.
- New fixFixed
PTC announced the broader Windchill and FlexPLM patch release: SUPs for 13.1.3 and 13.1.2, and standalone CPSXB patches for seven older branches.
- CISA added
CISA added CVE-2026-12569 to its catalogue of flaws used in attacks, with a 28 June federal remediation deadline, as recorded by NVD.
- New fixPartly fixed
PTC released patches for Windchill 13.0.2, followed that day by 12.1.2 and 12.0.2. Other branches followed on 19 June.
- Made publicNo fix yet
PTC published immediate remediation guidance for CVE-2026-12569.
Sources
- Customer & Partner Updates: Remote Code Execution Vulnerability in PTC’s Windchill and FlexPLM SolutionsPTC · 26 Aug 2026
- CVE-2026-12569: PTC-supplied vulnerability details and CISA catalogue entryNVD · 18 June 2026
- Clop ransomware targets Windchill, FlexPLM in data theft attacksBleepingComputer · 24 July 2026
- Shell investigates 'potential incident' after Clop data theft claimsBleepingComputer · 14 Aug 2026
- Clop Returns with Custom Implant in Mass-Extortion CampaignReliaQuest · 18 Aug 2026