This week, the team added coverage for an unauthenticated code execution chain impacting multiple versions of Gladinet CentreStack. The exploit combines a hardcoded cryptographic key vulnerability, an API authorization bypass vulnerability, and a SQL injection vulnerability to execute code as NT AUTHORITY\SYSTEM. These vulnerabilities haven't yet been reported as exploited in the wild; however, other CentreStack CVEs have seen a wide range of exploitation in the recent past: CVE-2025-11371 was targeted as part of a Cl0p ransomware campaign, per Huntress, and CVE-2025-11371 has VulnCheck Canary detections as recently as August 1, 2026. VulnCheck Target Intelligence currently reports a single-digit number of internet-exposed instances vulnerable to CVE-2026-54368, out of about 70 exposed CentreStack instances total.
Our exploit comes with a version scanner, network signatures, a Sigma rule, PCAPs, and ASM queries.
The team developed an exploit for CVE-2026-63077, a critical XStream deserialization vulnerability that yields unauthenticated remote code execution in JetBrains TeamCity through the agent polling protocol. CISA and VulnCheck KEV both added it on August 5, 2026, and JetBrains confirmed in-the-wild exploitation on August 7. A TeamCity server generally holds source code, credentials, and deployment access to everything downstream of it. Exploitation is trivial and pre-auth, and details are widely available. VulnCheck's work identified that the deserialization endpoint is not bound to POST, and a GET carrying the same body drops the payload just as well.
VulnCheck Target Intel identifies 1,446 internet-facing TeamCity servers. Our exploit ships with a Docker target, a version scanner, three PCAPs covering cleartext, TLS, and the GET delivery variant, Suricata and Snort rules, a Sigma rule, a YARA rule, and ASM queries.
By customer request, the team developed an original exploit for CVE-2025-53868, a high-severity command injection in F5 BIG-IP. BIG-IP's Appliance mode is a hardening control meant to confine even administrator accounts to a restricted shell limited to file transfer; this flaw lets such an account slip a second command past that restriction and run arbitrary commands as root over SSH, fully escaping the control. The vulnerability is not currently known to be exploited (but was notably one of the CVEs published immediately following a high-profile F5 intrusion disclosed in October 2025). VulnCheck Target Intelligence sees 142 of these appliances exposed to the internet, roughly 100 of them vulnerable. Because the attack runs entirely inside an encrypted SSH session, where network signatures cannot see it, detection is host-based: our exploit ships with a version scanner, PCAPs, a Sigma rule for the appliance's audit log, and ASM queries.
The team developed an exploit for CVE-2026-50148, a critical arbitrary file write to remote code execution in Metabase, a widely deployed open-source business intelligence and analytics platform that is routinely exposed to the internet for dashboards and embedded reporting. A Metabase account with permission to add or edit a database connection can write a file anywhere on the host and gain code execution as the Metabase service account; database-connection rights are a common permission level for analysts and admins, and many instances are reachable without network restrictions. The vulnerability was published on July 15, 2026 and hasn't yet seen any exploitation (which we would expect to change). VulnCheck Target Intelligence identifies roughly 320 internet-exposed Metabase instances. Our exploit ships with a version scanner, a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
The team developed an exploit for CVE-2026-60004, a remote code execution vulnerability in Gitea, one of the most widely self-hosted Git services on the internet. Any user who can create a repository can gain code execution as the Gitea service account on the host, and because Gitea ships with open registration enabled by default, an attacker with no prior access can register an account to reach that position. No in-the-wild exploitation has been reported yet, but Gitea is a high-value target: it stores source code, CI/CD secrets, and deploy keys, so a single compromised instance often opens a direct path into an organization's software supply chain. VulnCheck ASM queries surface over 8,200 internet-exposed Gitea instances. Our exploit ships with a version scanner, a Docker target, PCAPs, and Snort and Suricata detection rules.
The team developed an exploit for CVE-2026-14863, a high-severity OS command injection to remote code execution in FileRun, a popular self-hosted file manager and sharing platform that is frequently exposed to the internet as a private cloud-storage replacement. The vulnerability was discovered and disclosed by VulnCheck's own Valentin Lobstein. It lives in FileRun's thumbnail generation and is reachable both by any account with upload permission and, through FileRun's public file-request weblinks, with no credentials at all, so an unauthenticated visitor can run code as the web server user. No in-the-wild exploitation has been reported yet. The internet-exposed footprint is small (roughly 20 FileRun instances). Our exploit ships with Docker targets, PCAPs, Snort and Suricata rules, a YARA rule, and ASM queries. Get the full disclosure write-up on the VulnCheck blog.
The team developed an exploit for CVE-2026-8603, a critical OS command injection in ScadaBR, an open-source SCADA/HMI platform used for industrial monitoring and control. In practice, the vulnerability allows for command execution as root on the control-system host of a stock install; it is covered by CISA ICS advisory ICSA-26-139-03 but is not yet on any KEV lists. Our ZoomEye query returns about 117 results, a small but real internet-exposed footprint for a platform that drives physical process control and should not be reachable at all. Our exploit ships with a target Docker container, a version scanner, encrypted and unencrypted PCAPs, and Snort, Suricata, Sigma, and YARA rules.
The team added an exploit for CVE-2026-13448, a critical unauthenticated remote code execution vulnerability in Langflow, a popular open-source low-code platform for building LLM and AI-agent workflows that is frequently exposed to the internet as a visual builder and API service. An unauthenticated attacker can reach the public flow build endpoint and run code as the Langflow service user with no credentials. No in-the-wild exploitation has been reported, but Langflow is a proven target: A previous unauthenticated RCE, CVE-2025-3248, was added to KEV lists in May 2025 and has 3K+ VulnCheck Canary detections (the most recent being today), so an exposed instance carrying this new vuln makes for a logical attack target. VulnCheck Target Intelligence identifies roughly 316 internet-facing Langflow instances. Our exploit ships with a version scanner, a Docker target, encrypted and unencrypted PCAPs, Snort and Suricata rules, and ASM queries.
The team developed an exploit for CVE-2025-11201 a critical vulnerability in Databricks/MLflow's Tracking Server. MLflow tracking servers ship with zero authentication by default and are common, internet-facing infrastructure in the ML stack. Exploitation requires no preconditions. The fix in 2.22.4/3.0.0 is opt-in and defaults to unset, so many upgraded servers may remain exploitable. Our exploit comes with a version scanner, PCAPs, and Suricata/Snort signatures. Our Censys query finds approximately 1,100 exposed instances.
The team added an exploit for CVE-2026-62392, an OS command injection in Apache Kylin. An authenticated admin (or any user on a deployment that has turned on the non-default async-query yarn-queue option) can turn Kylin's async query submission path into arbitrary command execution as root; because Kylin ships with publicly documented default credentials, that admin bar is trivial on any instance that never changed them. Code execution on a Kylin node exposes the raw cube data, the underlying YARN cluster, and the database and cloud credentials sitting in kylin.properties, so a single compromise tends to open up the whole data platform behind it. No in-the-wild exploitation has been reported yet. Kylin is almost always deployed on internal infrastructure behind VPNs and exposes no reliable public fingerprint, so its internet-facing footprint is negligible. Our exploit ships with a version scanner, a Docker target, PCAPs, and Snort and Suricata detection rules.
Finally, the team added a feed entry for CVE-2026-20316, a vulnerability that was previously implemented as part of our CVE-2026-20079 exploit. This vulnerability has seen active exploitation in the wild, and has been added to both VulnCheck and CISA KEV. VulnCheck Target Intelligence finds roughly 60 Cisco FMC instances exposed to the internet.