March 28 - April 3, 2026

Happy Friday! Below are the Initial Access Intelligence team's deliverables for the past week.

CVE-2026-3055: Citrix NetScaler SAML IdP Memory Overread

The team developed an exploit for CVE-2026-3055, a critical information leak vulnerability in Citrix NetScaler ADC and Gateway. This vulnerability allows attackers to retrieve random memory from the NetScaler system and potentially access sensitive data. We covered this vulnerability because of customer requests and NetScaler's record of in-the-wild exploitation, but the team was skeptical of practical utility. The required configuration is unlikely to be common in real-world deployments, the attacker doesn't control which types of data are returned, and the attack itself is obvious — meaning an adversary would have to flood vulnerable endpoints in hopes of getting useful data back, far exceeding normal request volumes.

Our queries show between 5K and 10K potentially vulnerable systems. Our exploit comes with PCAPs, network signatures, YARA rules, and ASM queries.

CVE-2026-21643: Fortinet FortiClient EMS Unauthenticated Site Header SQL Injection

This week, the team added an exploit for an unauthenticated SQL injection vulnerability in Fortinet FortiClient EMS that permits an attacker to both extract data and obtain a remote shell on the target due to the superuser permissions under which the postgres user runs. Despite having a small number of affected versions and a small online footprint (~100 instances, per FOFA), CVE-2026-21643 has already seen in-the-wild exploit attempts. The vulnerability is on the VulnCheck KEV as of March 26, 2026. It is not yet on CISA KEV. Coverage includes an exploit, PCAPs, network signatures, ASM queries, and a YARA rule.

CVE-2026-27825 and CVE-2026-27826: Sooperset MCP-Atlassian Arbitrary File Read/Write SSRF

The team also added an exploit for a chain of two high-severity vulnerabilities in the popular MCP-Atlassian server. We initially worked on these vulnerabilities because when combined, they supposedly result in RCE. In our development and testing, the potential for RCE is highly situational and unlikely to exist in common configurations. This exploit delivers unauthenticated arbitrary file read and write capabilities that ultimately allow for disclosure of sensitive API keys — and in specific situations, RCE.

Our exploit comes with a target Docker container, PCAPs, and network rules. No ASM queries are provided because of a lack of fingerprintable elements in the default HTTP responses of this service; however, a target validation function has been provided.

CVE-2020-9054: Zyxel NAS Pre-Auth OS Command Injection Via Weblogin.cgi

By customer request, the team developed an exploit for CVE-2020-9054, a critical pre-auth command injection vulnerability in Zyxel NAS firmware 5.21 that allows for remote code execution via the NAS login page. The vulnerability has been exploited in the wild by the RondoDox, Emotet, BotenaGo, and Mirai botnets (among others). FOFA queries show more than 66K internet-exposed devices. Our exploit comes with PCAPs, Suricata and Snort rules, and ASM queries.

CVE-2026-2699: Progress ShareFile Authentication Bypass (Signatures and Queries Only)

The team delivered network signatures for a critical authentication bypass vulnerability in Progress ShareFile. We covered this vulnerability because the trivial bypass is likely to be exploited given that ShareFile is a high-value target for data theft and extortion. The team's ASM queries show around 1,000 potentially vulnerable internet-exposed systems.

CVE-2025-53521: BIG-IP APM Remote Code Execution (ASM Queries Only)

The team added ASM queries this week for CVE-2025-53521, a vulnerability in BIG-IP APM that was initially thought to be a DoS when it was disclosed after an F5 security incident in 2025. In March 2026, the vulnerability was reclassified as a remote code execution flaw; F5 noted it had also been exploited in the wild. Our queries show more than 153K BIG-IP systems online.

New Network Rules

To improve our rule coverage of VulnCheck KEV CVEs, along with what we believe are likely to be future VulnCheck KEV CVEs, we added network detections and PCAPs for the following vulnerabilities.