name: PTC FlexPLM WSDL Pre-Authentication Reconnaissance Fingerprint Analytic
signatureid: PXY-WEB14-RUN
category: 'Reconnaissance'
threatname: 'Active Scanning: Vulnerability Scanning'
functionality: 'Web Proxy'
description: |
Detects the pre-authentication reconnaissance stage that precedes exploitation of
CVE-2026-12569 in PTC Windchill PDMLink and FlexPLM. The remote code execution flaw in the
Windchill login servlet is not exploited in isolation; operators first chain a
pre-authentication information disclosure in the FlexPLM WSDL endpoint to confirm the target is
vulnerable and to enumerate the interface before triggering the deserialization exploit.
Ransom-ISAC documented this probe as a request to a JSP under the FlexPLM login path carrying a
wsdl query parameter, with a distinctive 4045 byte response indicating a vulnerable instance.
The response size is the discriminating element: the request path alone will match benign
service discovery and scanner traffic, whereas the specific response length reflects the
disclosed WSDL body returned by an unpatched host. Because this activity occurs before any
code execution or web shell deployment, it is the earliest signal available anywhere in this
attack chain and provides the widest response window. It is also the only detection in this
rule family that can identify targeting of hosts that were probed but not successfully
exploited, which is valuable for scoping an actor's target list.
reference:
- https://ransom-isac.org/blog/clop-windchill-flexplm-exploitation/
- https://www.helpnetsecurity.com/2026/06/29/ptc-windchill-cve-2026-12569-exploited/
- https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability
- https://attack.mitre.org/techniques/T1595/002/
- https://attack.mitre.org/techniques/T1190/
labels:
- attack.reconnaissance
- attack.t1595
- attack.t1595.002
- attack.initial_access
- attack.t1190
- Clop
- Cl0p
- FIN11
- CVE_2026_12569
- Windchill
- FlexPLM
- PLM
- Mass_Exploitation
logsource:
product: Web Proxy
category: proxy
detection:
selection_flexplm_login_path:
CsUriPath|contains:
- '/Windchill/rfa/jsp/login/'
selection_wsdl_query_discrete:
CsUriQuery|contains:
- 'wsdl'
selection_wsdl_query_concatenated:
CsUriPath|contains:
- '.jsp?wsdl'
selection_vulnerable_response_fingerprint:
ResponseSize:
- 4045
condition: selection_flexplm_login_path and (selection_wsdl_query_discrete or selection_wsdl_query_concatenated) and selection_vulnerable_response_fingerprint
verbose_info:
violation_summary:
grouping_attribute: 'accountname'
level2_attribute: 'devicehostname'
level2_metadata_attributes:
metadata_attributes:TECHNICAL DETAILS
Reconnaissance fingerprint (Ransom-ISAC):
GET /Windchill/rfa/jsp/login/*.jsp?wsdl
response_bytes = 4045
Exploit chain position:
1. WSDL information disclosure (CVSS 7.5) confirms a vulnerable FlexPLM instance
and exposes interface detail. <-- THIS RULE
2. Deserialization of untrusted data in the Windchill login servlet
(CVE-2026-12569, NVD 9.8 / vendor-cited 9.3) yields unauthenticated RCE.
3. JSP web shell written to the Windchill codebase login directory.
4. Operator interaction via header or query string channel.
Why the response size is required:
The path selector alone matches legitimate SOAP service discovery, monitoring probes,
and generic vulnerability scanners enumerating WSDL endpoints, none of which indicate
a vulnerable target. The 4045 byte response reflects the specific disclosed body
returned by an affected build. Removing selection_vulnerable_response_fingerprint
converts this into a broad scanning rule with materially higher noise, but doing so
deliberately is a reasonable choice during active incident scoping when the goal is
to enumerate every host that was probed.
Response size field caveat:
ResponseSize (customnumber17) must be populated by the log source. Some proxy
deployments populate ContentLengthServer (customnumber10) or RS_Bytes (customnumber16)
instead, and some populate byte counts that include header overhead, which will shift
the observed value away from exactly 4045. Validate against a known-good sample in
your environment before deployment; if your source reports total bytes rather than
body bytes, adjust the constant rather than removing the selector.
Criticality rationale:
Set to Medium rather than Critical because this is pre-exploitation activity. A match
indicates the host was identified as vulnerable, not that it was compromised. It should
drive urgent patch verification and a targeted hunt for web shells on the named host,
not an immediate incident declaration.
Hunt window:
Ransom-ISAC assesses Clop affiliates exploited this as a zero-day beginning in early
June 2026, with patches released June 17 and extortion emails beginning around July 20.
Scope retroactive searches to June 1 2026 at the latest. A patch applied after that
date does not remove a web shell planted before it.
False Positives:
- Low with the response size selector in place. Authorized vulnerability scanners and
penetration tests will match, since they perform the same probe. Correlate source
address against approved scanner infrastructure.
- Internal PTC support diagnostics may query WSDL endpoints. Validate source address
provenance before escalating.
Policy building walkthrough can be found in this previous post: