CVE Tools
Track your stack

JSP webshells being dropped on unpatched PTC Windchill instances

Help Net SecurityBy Zeljka Zorz

Reported exploitedWindchillFlexPLM

Our summary

CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities catalog, warning that PTC Windchill and FlexPLM are being targeted in the wild. PTC reports that attackers can exploit the improper input validation flaw (unauthenticated remote code execution) and has observed indicators consistent with JSP webshells being deployed on vulnerable systems.
Organizations using affected PTC product lifecycle management deployments should apply the relevant patches and check their environments for indicators of compromise.

Read at Help Net Security

Help Net Security publishes this story on its own site; we link to it rather than reprint it.

  1. BleepingComputerClop ransomware targets Windchill, FlexPLM in data theft attacksCVE-2026-12569, CVE-2026-4681
  2. SecurityWeekFirst-Ever Exploitation of PTC Windchill Vulnerability Discovered in the WildCVE-2026-12569, CVE-2026-4681
  3. Daily CyberSecurity (securityonline.info)CISA Adds Cisco Unified CM and PTC Windchill Flaws to KEV CatalogCVE-2026-12569, CVE-2026-4681
  4. Check Point Research24th August – Threat Intelligence ReportCVE-2026-12569
  5. Хакер (xakep.ru)Хак-группа Clop утверждает, что похитила у компании Shell 89 Гбайт данныхCVE-2026-12569
  6. SecurityWeekCl0p Ransomware Group Names Over 40 Victims of PTC Windchill CampaignCVE-2026-12569
  7. The Hacker NewsClop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering DataCVE-2026-12569
  8. BleepingComputerClop created custom web shell for Windchill data theft attacksCVE-2026-12569
  9. BleepingComputerPhilips and GE investigating Clop ransomware data theft claimsCVE-2026-12569
  10. BleepingComputerShell investigates 'potential incident' after Clop data theft claimsCVE-2026-12569

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store