FlagThis — Daily Cybersecurity Intelligence Briefing

The threat actor CL0P is executing a large-scale campaign targeting PTC Windchill and FlexPLM environments by exploiting CVE-2026-12569, a critical unauthenticated Remote Code Execution (RCE) vulnerability. The flaw originates from unsafe Java deserialization, enabling the deployment of a custom JSP web shell designed to map enterprise data vaults for intellectual property theft. A significant force multiplier is the compromise of integrated AI agents, which inherit high-level PLM access permissions to automate mass data exfiltration. Over 40 organizations have been impacted, with CVSS scores reaching 10.0. Immediate remediation requires updating to versions beyond 11.0 M030.