Clop ransomware operators are exploiting CVE-2026-12569, a critical unsafe deserialization vulnerability in PTC Windchill and FlexPLM, enabling unauthenticated remote code execution and JSP webshell deployment. This allows attackers to steal sensitive product lifecycle data from compromised instances. PTC began releasing patches on June 17, 2026, and issued private advisories with remediation guidance. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, with U.S. federal agencies ordered to secure affected systems within three days. German authorities also issued urgent patching warnings. Clop's exploitation involves deploying webshells for remote command execution and data exfiltration, continuing their pattern of targeting enterprise platforms for data theft extortion.

Successful exploitation allows unauthenticated attackers to execute arbitrary code remotely on Windchill and FlexPLM servers, deploy JSP webshells, and exfiltrate sensitive product data. This compromises confidentiality and integrity of enterprise product lifecycle management data, potentially leading to significant operational disruption and extortion demands. The vulnerability is actively exploited in the wild by a known ransomware gang with a history of high-profile data theft campaigns.

PTC has released official security patches for CVE-2026-12569 since June 17, 2026; customers should apply these patches immediately. Additionally, affected systems should be placed behind VPNs or trusted access gateways to restrict exposure. If compromise is suspected, isolate affected servers, collect forensic evidence, and rotate any exposed credentials before restoring services. Follow vendor advisories and government agency guidance for further remediation steps.