A cybercrime group known as Clop has reportedly exploited a critical zero-day vulnerability in PTC's Windchill and FlexPLM software, leading to claims of data theft from numerous organizations. The vulnerability, identified as CVE-2026-12569, allows unauthenticated attackers to execute code remotely.
PTC disclosed the vulnerability on June 17 and released a patch and initial indicators of compromise the following day. However, researchers suggest that some victims were likely compromised in early June, prior to the public disclosure. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-12569 to its catalog of known exploited vulnerabilities on June 25. PTC has continued to update its indicators of compromise as new information becomes available, but has not specified how it initially discovered the vulnerability or the extent of customer compromise.
Clop, a data theft extortion group active since 2020, began sending threatening emails to alleged victims in mid-July. This campaign follows a pattern observed in previous Clop attacks, which often involve exploiting zero-day vulnerabilities in supply chain or logistics software. The affected PTC products, Windchill and FlexPLM, are used by manufacturers and retailers, particularly in the manufacturing, aerospace, and automotive sectors, to manage supply chain systems and product lifecycles.
The group's claimed victim list is diverse. While point-of-sale restaurant management platform Toast and software vendor Zebra have confirmed detecting and containing system intrusions with limited impact, other alleged victims such as GE, Philips, and Shell have not commented on the claims.
Researchers have identified that Clop utilized a custom web shell after exploiting the vulnerability to gain access to PTC customer systems. This web shell is described as a fully equipped extortion platform specifically designed for Windchill, capable of decrypting credentials, delivering malware, and facilitating sustained access, network traversal, and data encryption. The toolkit is designed to mimic Windchill's standard functions, enabling attackers to move quickly from initial access to data theft and other post-exploitation activities without executing manual commands, thereby limiting detection by defenders.
This campaign is consistent with Clop's history of exploiting zero-day vulnerabilities in software holding sensitive data for mass extortion. The group is known to alternate between periods of inactivity and mass exploitation campaigns using custom web shells. Previous campaigns include the exploitation of Oracle E-Business Suite customers for over three months in 2025 and the MOVEit environments in 2023, which reportedly impacted more than 2,300 organizations.
