Cl0p Exploitation of PTC Windchill & FlexPLM (CVE-2026-12569)

This Ransom-ISAC advisory reports active Cl0p-affiliate exploitation of a critical PTC Windchill/FlexPLM RCE (CVE-2026-12569) chained with a FlexPLM WSDL information-disclosure to achieve unauthenticated RCE and deploy hex-named JSP webshells, followed by filesystem enumeration, data staging and a data extortion campaign; the report includes CVSS scores, IOCs (IPs, SHA-256, paths, malicious header), affected sectors (Manufacturing, Automotive, Aerospace, Retail), and remediation/hunting guidance.