CVE-2026-12569: PTC Windchill — Pre-auth RCE Enables Data Theft (July 2026)

CVE-2026-12569 — PTC Windchill

CVE-2026-12569 is a critical vulnerability in PTC Windchill and FlexPLM that allows remote code execution without authentication. With a CVSS rating of critical, this flaw has been exploited in the wild since July 20, 2026 by a Cl0p ransomware affiliate, enabling attackers to deploy webshells and exfiltrate sensitive enterprise data across multiple sectors.

Attack Vector

Attackers exploit CVE-2026-12569 by sending crafted requests to exposed Windchill or FlexPLM endpoints, achieving remote code execution before authentication. Post-exploitation, adversaries deploy webshells for persistent access, enumerate filesystems, stage data, and exfiltrate archives. Indicators of compromise published by PTC, Ransom-ISAC, and ReliaQuest include suspicious webshell activity and anomalous outbound data transfers. Extortion emails have been sent to hundreds of users, leveraging stolen data for ransom demands.

Who Is at Risk

All organizations running unpatched PTC Windchill and FlexPLM deployments are at immediate risk. Confirmed victims span aerospace, automotive, manufacturing, and retail sectors. PTC is directly affected, and the campaign is global in scope. Internet-exposed instances are especially vulnerable.

Patch & Mitigate

• Patch: Apply the official PTC security update for Windchill and FlexPLM immediately; check PTC advisories for exact version and patch deadline.
• Workaround: If patching is delayed, restrict external access to Windchill/FlexPLM interfaces and monitor for unauthorized connections.
• Detect: Review logs for unexpected webshell deployments, abnormal process execution, and large outbound data transfers. Reference IOCs from PTC, Ransom-ISAC, and ReliaQuest advisories.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit the pre-auth RCE to gain entry without credentials.
• TA0005 — Defense Evasion: Webshells are used to maintain persistence and evade detection.
• TA0010 — Exfiltration: Staged data is exfiltrated for extortion and potential sale.

Source: https://www.securityweek.com/ptc-windchill-vulnerability-exploited-in-ransomware-campaign/