Happy Friday! It's been an eventful week: The Initial Access Intelligence team's deliverables are below.
CVE-2026-66747: Zbtlink Router ENDLESSDOORS Implant Unauthenticated Root Code Execution
Earlier this week, VulnCheck disclosed ENDLESSDOORS, a remote-control implant in the firmware of 20+ Zbtlink router models. The implant is enabled by default, starts at boot, and runs as root. Unlike a conventional remote vulnerability, ENDLESSDOORS opens no listening port. It is a fully outbound, phone-home implant that dials a hardcoded C2 server over cleartext TCP with no authentication and no transport encryption. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted the implant: Anyone who answers at the C2 address, or who can occupy the network path between the router and that address, obtains root command execution on the device.
The team created an exploit that takes that C2 / adversary-in-the-middle position. Coverage also includes a PCAP, a Nuclei template for non-intrusive scanning, ASM queries, and Snort, Suricata, and YARA rules.
The team developed an exploit for CVE-2026-66066, a critical unauthenticated file-read-to-RCE vulnerability in Ruby on Rails Active Storage, discovered by Ethiack and nicknamed "KindaRails2Shell." This is a trivially reachable, unauthenticated flaw in one of the most widely deployed web frameworks on the internet, with public research already describing the mechanism. No exploitation has been reported yet, but given the deployment footprint and public information, we would expect it to follow shortly. Active Storage always enables the libvips loaders that are unsafe for untrusted content, so any app that renders image-upload variants with the default vips processor can be coerced into loading a malicious upload. Notably, we tested a patched 8.1.3.1 server and found that while the fix blocks the libvips file read, it does not neutralize the variation-key Marshal deserialization: the RCE gadget still executes on a patched server given a valid signature.
VulnCheck Target Intelligence identifies 7,100+ exposed vulnerable instances of Ruby on Rails. Our exploit ships with a Docker target, PCAPs, Suricata and Snort rules, a YARA rule, a Sigma rule, and ASM queries.
The team developed an exploit for CVE-2026-59309, a critical authentication bypass in VMware vCenter Server. The flaw lives in vCenter's built-in directory service, the component responsible for handling logins. A weakness in the way it checks passwords lets an attacker with network access sign in as a full administrator. The vulnerability was published on July 30, 2026, with public technical analysis appearing a day earlier, on July 29. We have not yet observed threat actors exploiting it in the wild, but vCenter is a long-standing, high-value target for ransomware crews and nation-state groups, since a single compromise can cascade across an organization's entire virtualized infrastructure. VulnCheck Target Intelligence currently identifies roughly 1,115 internet-exposed vCenter servers. Coverage includes the exploit, PCAPs, Suricata and Snort rules, and ASM queries.
The team also developed an exploit for CVE-2026-59310, another critical vulnerability in VMware vCenter Server. A flaw in the way the appliance records the log messages it receives lets an attacker on the network, with no username or password, plant a malicious file on the server and have it run automatically as the root system account. The issue was disclosed at the end of July 2026, and technical writeup is available as of July 29. No in-the-wild exploitation has been reported yet, but as mentioned above, ransomware groups love that a single vCenter target controls dozens or hundreds of virtual machines, which allows them to lock up an entire data center at once. Our exploit ships with a version scanner, PCAPs, a Sigma rule, Suricata and Snort rules, and ASM queries.
The team developed an exploit for CVE-2026-26128, a privilege escalation vulnerability in Microsoft Windows SMB services. A Unicode normalization mismatch allows an attacker to coerce an SMB service on a victim machine to authenticate via the attacker. The exploit enables an attacker with any user credentials to gain NT AUTHORITY/SYSTEM access to any domain-connected systems where those credentials are valid. The vulnerability was disclosed in March 2026; no exploitation has been reported yet. Our exploit ships with a PCAP, Suricata and Snort rules, an event log capture, and a Sigma rule.
Continuing the Windows theme, the team also added an exploit for CVE-2025-55680, a high-severity vulnerability in the Windows Cloud Files Mini Filter Driver that grants Medium integrity users SYSTEM privileges through an arbitrary file write. This is a trivially exploitable, highly reliable vulnerability with a wide range of Windows version applicability and multiple public write-ups or PoCs. No exploitation has been reported yet. Our exploit ships with a version scanner and a Sigma rule.
The team developed an exploit for CVE-2026-26216, a critical unauthenticated remote code execution in Crawl4AI, a popular open-source LLM-friendly web crawler that ships a Docker API server. Anyone who can reach the API runs OS commands as the container user; since JWT auth ships disabled by default, the endpoint is reachable with no token at all. No in-the-wild exploitation has been reported. The internet-exposed footprint is low (roughly a dozen Crawl4AI deployments). Our exploit ships with a Docker target, an unencrypted PCAP, Snort and Suricata detection rules, and ASM queries.
The team developed an exploit for CVE-2025-7340, a critical unauthenticated arbitrary file upload to remote code execution in HT Contact Form Widget For Elementor, a WordPress form-builder plugin with 250K+ active installations. Its upload handler runs unauthenticated and enforces no file-type check, so an unauthenticated visitor can drop a PHP webshell into the uploads directory and run code on a stock stack. It was added to VulnCheck KEV on May 4, 2026; it is not on CISA KEV. VulnCheck Target Intelligence surfaces around 30 exposed hosts. Our exploit ships with a version scanner, a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
The team developed an exploit for CVE-2024-9234, a critical unauthenticated arbitrary file upload to remote code execution in GutenKit, a Gutenberg page-builder plugin for WordPress with 80K+ active installations. Anyone who can reach the site can drop a PHP webshell into the plugins directory and run code. The vulnerability was added to VulnCheck KEV on April 23, 2025, and has since been used in a mass exploitation campaign documented by the Australian government in July 2026. It is not yet on CISA KEV. VulnCheck Target Intelligence finds a very small (single-digit) number of internet-exposed installations. Our exploit ships with a version scanner, a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
The team added an exploit for CVE-2024-11972, a critical unauthenticated arbitrary plugin installation in Hunk Companion, a ThemeHunk companion plugin for WordPress with 420K+ active installations. An unauthenticated REST route installs and activates any wordpress.org plugin with no capability check; our exploit chains the vulnerability with a vulnerable version of WP Query Console (CVE-2024-50498) whose eval sink turns that primitive into remote code execution. The vulnerability was added to VulnCheck KEV in December 2024, after it was leveraged to backdoor WordPress sites in a documented campaign; it is not on CISA KEV. VulnCheck Target Intelligence surfaces about a dozen exposed vulnerable hosts. Our exploit ships with a version scanner, a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
The team also developed an exploit for CVE-2024-2667, a critical unauthenticated arbitrary file upload to remote code execution in InstaWP Connect, a WordPress staging and migration plugin with 2M+ active installations. An unauthenticated REST route takes an attacker-supplied plugin ZIP and installs it before any credential check, so anyone who can reach the site plants a PHP webshell in the plugins directory and runs code. It was added to the VulnCheck KEV on April 12, 2024; it is not on CISA KEV. The plugin exposes no reliable Shodan or Censys fingerprint, so no ASM queries ship with it. Our exploit comes with a version scanner, a Docker target, PCAPs, Snort and Suricata rules, and a YARA rule.
The team developed an exploit for CVE-2023-51409, a critical unauthenticated arbitrary file upload to remote code execution in AI Engine, a popular WordPress plugin for chatbots and content generation. An unauthenticated visitor can drop a PHP webshell into the uploads directory and run code on a stock WordPress stack, with no plugin configuration required. It was added to the VulnCheck KEV on January 11, 2024 but is not yet on CISA KEV; Shadowserver is still observing regular exploit attempts as recently as August 6, 2026. VulnCheck Target Intelligence surfaces a single-digit number of exposed vulnerable hosts. Our exploit ships with a version scanner, a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.