# Cl0p-linked affiliates chain an unauthenticated PTC Windchill RCE with no login step at all

Source: https://startwithidentity.com/blog/2026-07-25-clop-affiliates-exploit-windchill-flexplm-unauthenticated-rce/
Last updated: 2026-08-06
License: content by Start with Identity. Cite the source URL.

---

ReliaQuest documented attacks chaining two flaws in PTC's Windchill and FlexPLM product lifecycle management software: a pre-authentication information disclosure bug in FlexPLM's WSDL endpoint (CVSS 7.5) that hands attackers reconnaissance data with no login required, and CVE-2026-12569, a critical remote-code-execution flaw in Windchill itself (CVSS 9.3). Chained together, an attacker never authenticates at any point, using the disclosed information to plant hex-named JSP web shells under `/Windchill/login/` and gain full remote code execution. The tradecraft observed matches previous Cl0p campaigns, tracked elsewhere as Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest, though ReliaQuest stopped short of confirming attribution outright. PTC added CVE-2026-12569 to CISA's Known Exploited Vulnerabilities catalog in late June, and Censys counted roughly 80 internet-exposed instances as of July 20, 2026, 80 percent of them in the US, with exposed instance counts falling sharply since the advisory published June 17.

## Why it matters

The recurring Cl0p pattern is exploiting internet-facing enterprise software with zero authentication step, MOVEit and GoAnywhere both fit this shape, rather than phishing or credential theft, which makes patch timing the entire defense: there's no MFA rollout or password policy that stops an RCE chain that never asks for a login. It's the same initial-access logic as the [Qilin ransomware campaign against a PAN-OS auth bypass](https://startwithidentity.com/blog/2026-07-21-qilin-ransomware-exploits-pan-os-auth-bypass-for-initial-access/) covered separately, different ransomware operation, same preference for unauthenticated entry over stolen credentials.

If Windchill or FlexPLM are anywhere in your environment, confirm you're past the June patch and check specifically for JSP web shells under `/Windchill/login/`, since the exposed-instance count falling since disclosure suggests active scanning for exactly this pattern.

Source: [The Hacker News](https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html)