THE Clop ransomware gang, also known as Cl0p, is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign. They are exploiting a critical vulnerability, CVE-2026-12569, which allows execution of arbitrary code on the affected systems. According to cybersecurity company ReliaQuest, Clop operators are using JSP webshells to steal sensitive data from compromised Product Lifecycle Management (PLM) platforms.
Clop ransomware hits Windchill via CVE-2026-12569 flaw
CyberSIXT Evidence Panel
Primary Source
nvd.nist.gov
CVE Intel
CISA KEV
Listed in KEV
Patch
Patch Status Unknown
Threat Actor
Clop
Article by CyberSIXT
Timeline Coverage
Swipe to explore timeline
-
Clop ransomware hits Windchill via CVE-2026-12569 flaw
databreaches.net
-
Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-20230
cybersixt.com
-
Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public
-
CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog
-
Cisco CUCM flaw allows hackers to gain root access in 24 hours
-
Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV
-
Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root
-
Cisco CM flaw lets attackers gain root via file write exploit
-
Cisco Unified CM flaw lets hackers gain root access via SSRF
-
Cisco patches SSRF flaw in Unified CM enabling root access
-
Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public
-
Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.
-
Cisco patches CVE-2026-20230 UC Manager flaw enabling root access