April 4 - April 10, 2026

Happy Friday! The following are the Initial Access Intelligence team's deliverables for the past week.

CVE-2026-35616: Fortinet FortiClient EMS Certificate Chain Authentication Bypass

This week, the team added an exploit for a critical authentication bypass vulnerability affecting versions 7.4.5 and 7.4.6 of FortiClient EMS. CVE-2026-35616 was added to the VulnCheck KEV following Defused Cyber's reports of in-the-wild exploit attempts on April 4. It was added to CISA KEV two days later. Our updated Shodan query shows just over 1,000 instances online.

CVE-2026-25939: frangoteam FUXA Unauthenticated Remote Arbitrary Scheduler Write

The team added an original exploit this week for a critical authorization bypass in FUXA, a web-based SCADA / HMI platform for industrial automation, IoT and real-time process visualization. The vulnerability arises from missing authorization that allows unauthenticated, remote attackers to create and modify arbitrary schedulers, which ultimately enables remote code execution in ICS and SCADA environments. The team's Censys query finds 200 or so instances on the public internet with fairly global distribution. Our exploit comes with ASM queries, a target Docker container, Snort and Suricata rules, a PCAP, and a YARA rule.

CVE-2026-28289: FreeScout Zero-Width Space Injection RCE

The team developed an exploit for CVE-2026-28289, a critical file upload vulnerability in FreeScout, an open-source help desk and mailing system. The vulnerability allows for unauthenticated remote code execution via the mail subsystem. Exploitation requires the ability to send messages to the FreeScout system and knowledge of a known valid user. Our Censys query finds more than 700 hosts online. Our exploit comes with a target Docker container, ASM queries, Suricata and Snort rules, and PCAPs.

CVE-2025-12548: Eclipse Che machine-exec Unauthenticated WebSocket RCE

The team developed an exploit for CVE-2025-12548, an unauthenticated RCE vulnerability in Eclipse Che and Red Hat OpenShift DevSpaces. The flaw sits in machine-exec, a WebSocket service that developer IDEs use to open terminals inside workspace containers — and that ships with authentication disabled by default. Any attacker who can reach the service can run arbitrary commands in a developer's workspace. A Metasploit module is publicly available, though no threat actors or botnets have been observed exploiting this in the wild as of yet. Red Hat OpenShift DevSpaces is fixed in 3.22.1; upstream Eclipse Che has no code-level fix. Coverage includes an exploit with PCAPs and Suricata rules.

CVE-2024-21762: Fortinet FortiOS Out-of-Bounds Write RCE

By customer request, the team developed an exploit for CVE-2024-21762, a critical out-of-bounds write RCE vulnerability in Fortinet FortiOS that's been exploited by several China-nexus threat actors in addition to the Mirai botnet and multiple ransomware groups. The team's exploit joins previously delivered network rules and PCAPs and also adds ASM queries, which show roughly 500K internet-facing results.

PCAPs Normalized

All PCAPs have been standardized to include Ethernet frames and non-loopback addresses, ensuring consistent formatting across the dataset.

New Signatures and PCAPs Added