PTC Windchill Vulnerability Exploited in Ransomware Campaign

The critical unsafe deserialization flaw allows attackers to execute arbitrary code remotely, without authentication. The post PTC Windchill Vulnerability Exploited in Ransomware Campaign appeared first on SecurityWeek .

Report facts: The article describes active exploitation of a critical unauthenticated remote code execution vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM due to unsafe deserialization of untrusted data, used by a Cl0p ransomware affiliate to deploy web shells and gain persistent access to engineering and manufacturing environments.[3][9][10] The flaw allows arbitrary code execution via crafted HTTP requests against exposed Windchill/FlexPLM endpoints, with confirmed ransomware operations and high CVSS criticality.[5][6][12] RealGround analysis: For AI-adopting organizations, Windchill/FlexPLM often sit inside product, CAD, and manufacturing data pipelines that may feed or be integrated with ML models and AI agents; compromise of these PLM systems becomes an AI supply-chain risk because poisoned or exfiltrated design data can corrupt downstream AI training sets, decision-support tools, and autonomous engineering agents. Practically, organizations should treat vulnerable PLM platforms as critical dependencies in their AI stack: perform SBOM-driven dependency mapping, ensure rapid patching and network segmentation of Windchill/FlexPLM, and monitor for web shells and anom