{"uuid": "b45b42ae-b21f-4461-a12d-dbc2a392d134", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "exploited", "source": "https://t.me/baseleeak/393", "content": "\ud83d\udd10 INCIDENT: SMAPCENTER.UAH.EDU\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: SMAPCENTER.UAH.EDU\n\n\ud83c\udfe2 About the organization: SMAP Center (Systems Management and Production Center) is a research center at the University of Alabama in Huntsville (UAH). The center participates in U.S. Department of Defense research, particularly on diminishing manufacturing sources and material shortages (DMSMS) in weapon systems, and also runs STEM education and medical simulation projects (MEDNET). UAH's annual research expenditure is about $154.5 million, with 17 research centers at the university. The center's estimated revenue is $113 million.\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 6.08 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 Databases\n\u2022 Project files\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA:\n\n\u2022 Compromised employees: not disclosed\n\u2022 Compromised users: not disclosed\n\u2022 Third-party employee credentials: not disclosed\n\u2022 External attack surface: not disclosed\n\nNote: No HudsonRock data was found for SMAPCENTER.UAH.EDU. The attack vector was a server-side application vulnerability (PTC Windchill RCE), not endpoint infostealer malware, so no infostealer credential data is expected for this target. To verify manually, the domain can be checked via HudsonRock's free lookup tool.\n\n\ud83c\udf10 INFRASTRUCTURE:\n\n\u2022 IP address: 146.229.99.30, Huntsville, Alabama, USA\n\u2022 ASN: AS10364, University of Alabama in Huntsville (UAH)\n\u2022 Subdomain: apps.smapcenter.uah.edu (time-tracking system, protected by DUO MFA)\n\u2022 Owning entity: Systems Management and Production Center, UAH research center, network range 146.229.0.0/16\n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. The attack is part of a large-scale Clop campaign in August 2026 linked to the exploitation of critical vulnerability CVE-2026-12569 (CVSS 9.3) in PTC Windchill and FlexPLM. The vulnerability is an insecure deserialization flaw enabling remote code execution via the wt.fv.uploadtocache.DoUploadToCache_Server upload path. In Windchill environments, Clop deployed a custom JSP web shell capable of decrypting credentials, enumerating file vaults, and exfiltrating engineering data, receiving commands via a custom X-windchill-req HTTP header. The same campaign wave included Shell, Philips, General Electric, and roughly 50 other organizations. According to Clop's statement, \"The full leak will be published soon, unless a university representative contacts us.\" At this time, there is no independent confirmation of the leak and no official statement from UAH or the SMAP Center.\n\n\ud83d\udcab Note: The SMAP Center is tied to defense research and management systems for the U.S. Department of Defense, which makes it a particularly sensitive target for extortionists.\n\n---", "creation_timestamp": "2026-09-19T01:00:03.629705Z"}