NewsThe Hacker News2026-07-25 10:14 UTCManufacturing ICS / OT (industrial control)

Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. "Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling

Other advisories

CVE-2026-77646high
PTC Windchill und FlexPLM: Mehrere Schwachstellen
CVE-2026-12569critical
PTC FlexPLM: Schwachstelle ermöglicht Codeausführung
CVE-2026-12569critical
ptc flexplm: Deserialisierung nicht vertrauenswuerdiger Daten
CVE-2026-12569critical
ptc flexplm: Deserialisierung nicht vertrauenswuerdiger Daten

Other news entries

Vulnerabilitybsi-cert-bund-wid2026-08-21
PTC Windchill und FlexPLM: Mehrere Schwachstellen
Newsthehackernews2026-08-19
Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
Newsbleepingcomputer2026-08-18
Clop created custom web shell for Windchill data theft attacks
Newsbleepingcomputer2026-07-24
Clop ransomware targets Windchill, FlexPLM in data theft attacks
Vulnerabilitysans-newsbites-mail2026-06-30
Patch Now: Critical PTC Windchill Vulnerability
Newscsoonline2026-06-26
Hackers exploit critical PTC Windchill PLM software flaw
Newsthehackernews2026-06-26
CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue
Vulnerabilitysans-newsbites-mail2026-06-24
KEV: Lantronix, Ubiquiti UniFi OS, PTC Windchill and FlexPLM, and Cisco Unified Communications Manager

Source: https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html

More on FlexPLM