CVE-2026-12569 is an unauthenticated remote code execution vulnerability in PTC Windchill PDMLink and FlexPLM. The flaw, rooted in unsafe deserialization, carries a CVSS score of 9.8 according to the NVD, while PTC’s own assessments range from 9.3 to 10.0. Affected releases include versions prior to 11.0 M030 and multiple subsequent iterations.
The threat actor identified as Hazy Scorpius—also tracked as GRACEFUL SPIDER, TA505, FIN11, and Lace Tempest—began exploiting this zero-day in early June 2026. PTC issued a disclosure on June 17, followed by a patch on June 18. By June 25, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating remediation for federal agencies within three days.
Mass exploitation, confirmed by ReliaQuest between July 20 and July 26, has produced more than 40 confirmed victims on the CLOP leak site as of mid-August. The victimology spans manufacturing, automotive, aerospace, retail, and energy sectors—including Shell—with a heavy concentration of US-based PTC customers. This fits the established CLOP operational pattern of targeting managed file transfer and enterprise software: Accellion FTA (2020-2021, 100-plus organizations), GoAnywhere MFT (2023, 130-plus in 10 days), MOVEit (2023, up to 2,700 organizations and roughly $100 million in revenue), Cleo (2024), and Oracle EBS (2025). Campaigns recur at 10-14 month intervals.
The attack chain starts with a pre-authentication information disclosure in the FlexPLM WSDL endpoint (CVSS 7.5), which attackers use to enumerate targets before triggering the deserialization RCE. Post-exploitation, they deploy hex-named JSP webshells under /Windchill/login/
, enumerate the filesystem via flst.txt
, load a custom Java class for arbitrary execution, and exfiltrate engineering data for double-extortion. Extortion emails with the subject line “Windchill PDMLink module serious data leak” were first observed July 20. Unit 42 confirmed active monitoring of the exploitation on August 7. Ransom-ISAC published updated indicators of compromise on August 14.
The agent-native dimension is straightforward. AI agents integrated with Windchill for PLM and engineering workflows operate with the permissions of the underlying system. A compromised Windchill instance means the agent’s credentials, data access, and execution context are all inside the attacker’s perimeter. The agent does not need to be directly targeted—it inherits the breach.
Check Point identified 19 or more affected product versions as of July 29. PTC updated its advisory, CS473270, on July 27 with 11 additional addresses and a webshell hunting pattern. Organizations running unpatched instances remain exposed. IOCs to hunt: the HTTP header X-windchill-req: ?x8Fmgow
, hex-named JSP files under /Windchill/login/
, and artifacts named GW.class
, payload.bin
, and flst.txt
.