Is CVE-2025-3866 known to be exploited?

It is not marked known-exploited in this record.

CVE-2025-3866

Apply vendor patches for CVE-2025-3866 immediately. Monitor for indicators of compromise associated with the JSP web shell. Restrict network access to Windchill and FlexPLM servers. Review logs for unauthorized JSP file deployment.

Quick answers

What is CVE-2025-3866?: Apply vendor patches for CVE-2025-3866 immediately. Monitor for indicators of compromise associated with the JSP web shell. Restrict network access to Windchill and FlexPLM servers. Review logs for unauthorized JSP file deployment.
How severe is CVE-2025-3866?: high, CVSS 9.8
Is CVE-2025-3866 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2025-3866 be mitigated?: Apply vendor patches for CVE-2025-3866 immediately. Monitor for indicators of compromise associated with the JSP web shell. Restrict network access to Windchill and FlexPLM servers. Review logs for unauthorized JSP file deployment.

CVSS

9.8

Vendor

PTC

Published

Sep 30, 2026 · 08:05

Patch

Unknown / not confirmed

Affected products

Windchill, FlexPLM

Mitigation

Clop-Linked Web Shell Exploits PTC Windchill Flaw to Decrypt Credentials and Map Engineering Data

A JavaServer Pages web shell, attributed to the Clop ransomware group, has been deployed in the wild following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers. The shell functions as an extortion platform capable of mapping sensitive vault data and decrypting credentials. The vulnerability, tracked as CVE-2025-3866, affects enterprise Product Lifecycle Management environments. PTC and ReliaQuest have been referenced in connection with the flaw and its analysis, respectively. The full extent of victim impact and data exfiltration remains under investigation.

—1m

CVE-2025-3866

Quick answers

Related News

Clop-Linked Web Shell Exploits PTC Windchill Flaw to Decrypt Credentials and Map Engineering Data