More than 40 companies have been named so far in a campaign that chains two flaws in PTC's Windchill and FlexPLM software into unauthenticated remote code execution.
Cl0p has now named more than 40 organizations, in full, on its extortion site — Shell, Philips, Fiserv, Zebra Technologies, Toast, Ingersoll Rand, Mindray, and Largan Precision among them — as victims of a campaign built entirely around one flaw: CVE-2026-12569, a 9.3-severity bug in PTC's Windchill and FlexPLM product-lifecycle-management software. It's the first Windchill vulnerability ever exploited in the wild, and the attackers didn't need a single stolen password to get in.
The bug that let them walk in the front door
PLM software like Windchill and FlexPLM sits at the center of how manufacturers track product designs, bills of materials, and supplier data — which is exactly why Cl0p's victim list skews so heavily toward manufacturing, automotive, aerospace, and retail/apparel. The exploit chain here is genuinely elegant, in the way that only makes it worse for defenders: attackers first hit a pre-authentication information-disclosure flaw in FlexPLM's WSDL endpoint, which leaks just enough about the target's configuration to set up the second stage. That second stage is a server-side flaw in the Windchill login servlet — the literal page you'd normally type a password into — that lets them skip authentication entirely and execute code, per Help Net Security.
The two-stage exploit chain
Stage 1
Stage
FlexPLM WSDL endpoint
Component
Pre-auth information disclosure — leaks configuration data needed for stage 2
Dropped under /Windchill/login/, disguised among legitimate session files
Post-exploitation
Keystore mapping
Attackers decrypt every credential stored in the Windchill keystore
That last row is the part I'd flag hardest to any security team reading this. Getting into one Windchill instance is bad. Decrypting the entire credential keystore on the way out means the attacker potentially walks away with the keys to everything Windchill was ever configured to talk to — other internal systems, service accounts, the works. That's a different, worse category of incident than 'files were stolen.'
Who's already been hit
Cl0p's naming pattern here is worth understanding on its own. The gang initially listed only partial company names on its leak site — the classic extortion pressure tactic of letting a company guess whether it's actually been named before the full reveal. Starting August 12, according to SecurityWeek, Cl0p began publishing full names. As of this writing, that list runs past 40 organizations, spanning:
Shell — oil and gas
Philips — medical devices and electronics
Fiserv — fintech and payments infrastructure
Zebra Technologies — enterprise mobility and barcode hardware
Toast — point-of-sale software
Ingersoll Rand — industrial equipment
Mindray — medical devices
Largan Precision — optics and electronics components
Confirmed Windchill victims cluster in manufacturing, automotive, aerospace, and retail/apparel — sectors that lean hardest on PLM software to track designs and supply chains. · Unsplash
The first-ever Windchill vulnerability exploited in the wild — and Cl0p turned it into the biggest single-CVE PLM breach campaign we've tracked this year.
Why Cl0p is naming names now
If you run Windchill or FlexPLM, do this today
Apply PTC's patches, which began shipping June 18, 2026 — confirm every Windchill and FlexPLM instance is covered, not just the primary one.
2
Search for hex-named JSP files under /Windchill/login/ — that's the specific webshell pattern attackers used, per [The Hacker News](https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html).
3
Treat any instance that was internet-facing and unpatched between disclosure and your patch date as potentially already compromised, not just vulnerable.
4
Rotate every credential stored in the Windchill keystore if you find any sign of compromise — the exploit chain specifically targets and decrypts that store.
What is CVE-2026-12569?
A deserialization-of-untrusted-data vulnerability (CVSS 9.3) in PTC Windchill and FlexPLM that can be exploited without authentication when chained with a pre-auth information disclosure flaw in the FlexPLM WSDL endpoint, resulting in remote code execution.
Has my company been named by Cl0p?
Cl0p publishes its victim list on its own extortion site. If you run Windchill or FlexPLM and haven't confirmed your patch status, don't wait for a name to appear — check your logs for the webshell pattern described above now.
When did PTC patch this?
PTC began shipping patches on June 18, 2026, with additional affected versions patched in the weeks after. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same month.
Is this related to other 2026 Cl0p campaigns?
Cl0p has a pattern of running mass-exploitation campaigns against a single enterprise software flaw and then extorting every victim it can identify — this is the same playbook, this time built around Windchill and FlexPLM instead of a file-transfer product.
This one belongs in the same file as DentaQuest's 15-million-record breach and AnMed's ransomware fallout — not because the attackers are related, but because the pattern is. It's also part of a broader ransomware trend we've been tracking, where the technical sophistication keeps climbing — gangs like Deadlock hiding infrastructure on the blockchain and Gunra skipping MFA entirely — even as the entry point stays embarrassingly simple: one unpatched flaw. If you're patched, verify it. If you're not sure, that's the actual emergency, not the headline.
