Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

Threat actors linked to the Cl0p ransomware group are actively chaining unauthenticated remote code execution vulnerabilities in PTC Windchill and FlexPLM — enterprise product lifecycle management platforms — to deploy web shells and exfiltrate sensitive design and product data. The root cause is a failure to patch known critical vulnerabilities in internet-exposed systems, compounded by the absence of network segmentation that would limit attacker access after initial compromise. CVE-2026-12569 was already listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning affected organizations had explicit warning and a federal mandate to remediate. This campaign is particularly damaging in critical manufacturing, aerospace, and automotive sectors where stolen product data can have severe competitive, regulatory, and national security implications.