CVE Tools
Track your stack

CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue

The Hacker NewsBy The Hacker News

Reported exploitedPTC WindchillPTC FlexPLM

Our summary

CISA has added a actively exploited remote code execution flaw to its Known Exploited Vulnerabilities (KEV) catalog, affecting PTC Windchill PDMlink and PTC FlexPLM. The issue is tracked as CVE-2026-12569 (CVSS 9.3), where improper input validation can enable arbitrary code execution. PTC reports that attackers are continuing to use the vulnerability to install JSP web shells on vulnerable systems, underscoring the risk of rapid weaponization after patch releases.

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. Check Point Research24th August – Threat Intelligence ReportCVE-2026-12569
  2. Хакер (xakep.ru)Хак-группа Clop утверждает, что похитила у компании Shell 89 Гбайт данныхCVE-2026-12569
  3. SecurityWeekCl0p Ransomware Group Names Over 40 Victims of PTC Windchill CampaignCVE-2026-12569
  4. The Hacker NewsClop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering DataCVE-2026-12569
  5. BleepingComputerClop created custom web shell for Windchill data theft attacksCVE-2026-12569
  6. BleepingComputerPhilips and GE investigating Clop ransomware data theft claimsCVE-2026-12569
  7. BleepingComputerShell investigates 'potential incident' after Clop data theft claimsCVE-2026-12569
  8. SecurityWeekPTC Windchill Vulnerability Exploited in Ransomware CampaignCVE-2026-12569
  9. The Hacker NewsCl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCECVE-2026-12569
  10. BleepingComputerClop ransomware targets Windchill, FlexPLM in data theft attacksCVE-2026-12569

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store