The Cl0p ransomware group has named more than 40 organizations allegedly targeted in the recent campaign that exploited a vulnerability in PTC’s product lifecycle management (PLM) platforms Windchill and FlexPLM. The vulnerability and its exploitation The exploitation of the vulnerability, tracked as CVE-2026-12569, came to light in June, when CISA added it to its KEV catalog and the vendor warned of attacks targeting it. The flaw is an improper input validation issue that allows a remote, unauthenticated attacker to achieve arbitrary code execution via specially crafted requests. Exploitation of the vulnerability was expected, with police in Germany reportedly alerting organizations about imminent attacks. It’s worth noting that CVE-2026-12569 is the first ever Windchill vulnerability to…