Improper input validation in PTC Windchill/FlexPLM servers allows remote attackers to execute arbitrary code via a crafted network request. Reported exploitation deploys a JSP web shell that decrypts credentials from the Windchill keystore and enumerates vault data for exfiltration, enabling lateral movement and ransomware. Apply vendor patches and hunt for unexpected .jsp files.