CLOP Is Mass-Exploiting PTC Windchill at Scale. Every AI Agent Connected to It Inherits the Breach.

CVE-2026-12569, an unauthenticated remote code execution vulnerability in PTC Windchill PDMLink and FlexPLM with a CVSS score of 9.8, is being mass-exploited by the threat actor Hazy Scorpius (also known as GRACEFUL SPIDER, TA505, FIN11, and Lace Tempest), with more than 40 confirmed victims on the CLOP leak site as of mid-August. The attack chain begins with a pre-authentication information disclosure in the FlexPLM WSDL endpoint (CVSS 7.5) and leads to deployment of hex-named JSP webshells, with extortion emails first observed July 20. AI agents integrated with Windchill inherit the breach because they operate with the permissions of the compromised system, making them vulnerable without direct targeting.

CVE-2026-12569 is an unauthenticated remote code execution vulnerability https://nvd.nist.gov/vuln/detail/CVE-2026-12569 in PTC Windchill PDMLink and FlexPLM. The flaw, rooted in unsafe deserialization, carries a CVSS score of 9.8 according to the NVD, while PTC’s own assessments range from 9.3 to 10.0. Affected releases include versions prior to 11.0 M030 and multiple subsequent iterations. The threat actor identified as Hazy Scorpius https://www.crowdstrike.com/en-us/adversaries/graceful-spider/ —also tracked as GRACEFUL SPIDER, TA505, FIN11, and Lace Tempest—began exploiting this zero-day in early June 2026. PTC issued a disclosure on June 17, followed by a patch on June 18. By June 25, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog , mandating remediation for federal agencies within three days. Mass exploitation, confirmed by ReliaQuest between July 20 and July 26 https://reliaquest.com/blog/clop-returns-with-custom-implant-in-mass-extortion-campaign/ , has produced more than 40 confirmed victims on the CLOP leak site as of mid-August. The victimology spans manufacturing, automotive, aerospace, retail, and energy sectors—including Shell—with a heavy concentration of US-based PTC customers. This fits the established CLOP operational pattern https://www.ptc.com/en/support/article/CS473270 of targeting managed file transfer and enterprise software: Accellion FTA 2020-2021, 100-plus organizations , GoAnywhere MFT 2023, 130-plus in 10 days , MOVEit 2023, up to 2,700 organizations and roughly $100 million in revenue , Cleo 2024 , and Oracle EBS 2025 . Campaigns recur at 10-14 month intervals. The attack chain starts with a pre-authentication information disclosure in the FlexPLM WSDL endpoint CVSS 7.5 , which attackers use to enumerate targets before triggering the deserialization RCE. Post-exploitation, they deploy hex-named JSP webshells under /Windchill/login/ , enumerate the filesystem via flst.txt , load a custom Java class for arbitrary execution, and exfiltrate engineering data for double-extortion. Extortion emails with the subject line “Windchill PDMLink module serious data leak” were first observed July 20. Unit 42 confirmed active monitoring https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-08-06-Hazy-Scorpius-Exploitation-of-CVE-2026-12569.txt of the exploitation on August 7. Ransom-ISAC published updated indicators of compromise https://ransom-isac.org/blog/clop-windchill-flexplm-exploitation/ on August 14. The agent-native dimension is straightforward. AI agents integrated with Windchill for PLM and engineering workflows operate with the permissions of the underlying system. A compromised Windchill instance means the agent’s credentials, data access, and execution context are all inside the attacker’s perimeter. The agent does not need to be directly targeted—it inherits the breach. Check Point identified 19 or more affected product versions as of July 29. PTC updated its advisory, CS473270, on July 27 with 11 additional addresses and a webshell hunting pattern. Organizations running unpatched instances remain exposed. IOCs to hunt: the HTTP header X-windchill-req: ?x8Fmgow , hex-named JSP files under /Windchill/login/ , and artifacts named GW.class , payload.bin , and flst.txt .