Cl0p affiliates leverage Windchill/FlexPLM RCE chain for data extortion
Ransom-ISAC’s advisory details how Cl0p affiliates chain a pre‑auth FlexPLM WSDL disclosure with a critical Windchill login servlet flaw (CVE‑2026‑12569) to achieve unauthenticated remote code execution and drop JSP web shells. The campaign targets internet‑exposed engineering data in manufacturing, automotive, aerospace and retail, enabling double‑extortion theft.