SecurityWeekEduard Kovacs
PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569
Part of the CVE-2026-12569 story · since 25 Jun
Quiet for 12 weekslast report 21 Aug11 articles5 outlets
- Thu 25 Jun, 22:21 UTC. CISA, first report. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
- Fri 26 Jun, 03:31 UTC. SecurityOnline, its first report on the story. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
- Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
- Fri 26 Jun, 06:19 UTC. CISA. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
- Fri 26 Jun, 08:31 UTC. SecurityWeek, its first report on the story. PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569. Cites a CVE in CISA KEV. This article, 5th of 11.
- Fri 26 Jun, 11:31 UTC. Security Affairs, its first report on the story. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
- Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
- Fri 24 Jul, 12:51 UTC. DataBreaches, its first report on the story. Clop ransomware hits Windchill via CVE-2026-12569 flaw. Cites a CVE in CISA KEV.
- Mon 27 Jul, 13:31 UTC. SecurityWeek. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw. Cites a CVE in CISA KEV.
- Wed 19 Aug, 11:32 UTC. SecurityWeek. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign. Cites a CVE in CISA KEV.
- Fri 21 Aug, 08:20 UTC. Security Affairs. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips. Cites a CVE in CISA KEV.
A vulnerability in PTC Windchill, labeled CVE-2026-12569, has been exploited in real-world attacks, allowing remote, unauthenticated attackers to execute arbitrary code through crafted requests. CISA has added this issue to its Known Exploited Vulnerabilities catalog and instructed federal agencies to implement remediation by June 28. PTC is actively distributing patches, having started on June 17, after discovering attacks deploying JSP webshells for remote command execution.
Windchill is widely used in critical sectors like automotive and aerospace, accentuating the threat to supply chains and operational technology. Authorities previously warned of exploitation risks associated with another PTC vulnerability, CVE-2026-4681, though no attacks were reported at that time.
How the story developed
Quiet for 12 weekslast report 21 Aug11 articles5 outlets
11 articles from 5 outlets since 25 Jun. Quiet since 21 Aug. This was the 5th report, 10 hours after the first.
- Thu 25 Jun, 22:21 UTC. CISA, first report. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
- Fri 26 Jun, 03:31 UTC. SecurityOnline, its first report on the story. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
- Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
- Fri 26 Jun, 06:19 UTC. CISA. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
- Fri 26 Jun, 08:31 UTC. SecurityWeek, its first report on the story. PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569. Cites a CVE in CISA KEV. This article, 5th of 11.
- Fri 26 Jun, 11:31 UTC. Security Affairs, its first report on the story. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
- Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
- Fri 24 Jul, 12:51 UTC. DataBreaches, its first report on the story. Clop ransomware hits Windchill via CVE-2026-12569 flaw. Cites a CVE in CISA KEV.
- Mon 27 Jul, 13:31 UTC. SecurityWeek. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw. Cites a CVE in CISA KEV.
- Wed 19 Aug, 11:32 UTC. SecurityWeek. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign. Cites a CVE in CISA KEV.
- Fri 21 Aug, 08:20 UTC. Security Affairs. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 11 articles as a listHide the list
- Thu 25 JunDay 01
- Critical PTC Windchill flaw CVE-2026-12569 under active attack22:21 · CISA · official · First report · CISA alert · Known exploited CVE
- Fri 26 JunDay 16
- Cisco and PTC flaws under active attack, CISA adds to KEV list03:31 · SecurityOnline · Known exploited CVE
- PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return05:40 · SecurityOnline · Known exploited CVE
- PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-1256908:31 · SecurityWeek · Known exploited CVE · This article, 5th of 11
Show 3 more from 26 Jun
- Critical PTC Windchill flaw CVE-2026-12569 under active attack06:19 · CISA · official · Known exploited CVE
- CISA adds critical PTC Windchill, Cisco UC flaws to KEV list11:31 · Security Affairs · Known exploited CVE
Quiet for 4 weeks
Fri 24 JulDay 291- Clop ransomware hits Windchill via CVE-2026-12569 flaw12:51 · DataBreaches · Picked up again · Known exploited CVE
Quiet for 3 days
Mon 27 JulDay 321- Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw13:31 · SecurityWeek · Picked up again · Known exploited CVE
Quiet for 3 weeks
Wed 19 AugDay 551- Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign11:32 · SecurityWeek · Picked up again · Known exploited CVE
Quiet for 2 days
Fri 21 AugDay 571- Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips08:20 · Security Affairs · Known exploited CVE