Clop ransomware targets Windchill, FlexPLM in data theft attacks

The Clop ransomware gang is actively exploiting CVE-2026-12569, a critical remote code execution vulnerability in PTC Windchill and FlexPLM — platforms widely used in product lifecycle management. By deploying web shells after initial exploitation, attackers gain persistent access to exfiltrate sensitive engineering and business data before demanding ransom. The fact that both CISA and German authorities issued urgent warnings indicates this is a widespread, actively weaponized threat. Organizations running unpatched versions of these systems face not only data theft but also significant regulatory and operational consequences. This incident underscores that delays in patching internet-facing enterprise software directly translate into exploitable attack windows for sophisticated threat actors.