Happy Friday! The weekly VulnCheck exploit train is commonly a freight train nowadays. Below are the Initial Access Intelligence team's deliverables for the past week.
This week, the team wrote an exploit for an unauthenticated RCE chain against on-premises Microsoft SharePoint (2016, 2019, and Subscription Edition), pairing an alg:none JWT authentication bypass (CVE-2026-55040) with an unsafe .NET type instantiation in Business Connectivity Services (CVE-2026-63520). The vulnerabilities were disclosed by Rapid7, though no exploit has been released publicly for the full chain. Our exploit capitalizes on Stephen Fewer's auth bypass PoC and then implements the second part of the chain to attain full RCE. The authentication bypass was added to VulnCheck KEV on August 12 amid reported exploitation; it was added to CISA KEV six days later. VulnCheck Target Intelligence reports over 8,000 SharePoint instances exposed to the internet. Our exploit ships with a version scanner, PCAPs, Suricata and Snort rules, and ASM queries.
The team added an exploit for CVE-2026-72898, a maximum-severity unauthenticated SQL injection in Metabase's password-reset flow. The injection is publicly disclosed, but our exploit escalates it to remote code execution against the default H2 application database, which we did not find documented anywhere, and it also reaches code execution on Postgres deployments. This is a pre-auth, CVSS 10, exploited vulnerability that's reachable through a single unauthenticated request to a default endpoint. VulnCheck added it to KEV on August 6, 2026, five days before CISA followed on August 11. VulnCheck Target Intelligence identifies roughly 1,760 exposed Metabase instances online. Our exploit ships with a version scanner, a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
The team also added an exploit for CVE-2026-48282, an unauthenticated path traversal vulnerability that delivers arbitrary file read and write via a misconfiguration in Adobe ColdFusion's RDS service. The vulnerability was added to VulnCheck KEV on July 2, 2026 amid reported exploitation; it joined CISA KEV on July 7, five days later. ColdFusion remains relatively popular and has a solid internet-exposed population. VulnCheck Target Intelligence currently tracks 17,000+ installs. Our exploit includes a Docker target, PCAPs, and ASM queries.
The team added an exploit for CVE-2026-77647, a critical unauthenticated RCE vulnerability in SPIP (an open-source PHP publishing system) that was exploited as a zero-day and added to VulnCheck KEV on August 20, 2026. It is not yet on CISA KEV. A single unauthenticated request to the public /spip.php runs code as the web user through the template engine's environment export. The flaw is fixed in 4.4.21; SPIP's earlier 4.4.20 release fixed it incompletely, so our exploit and version check cover every affected build below 4.4.21. VulnCheck Target Intelligence identifies roughly 600 SPIP instances online. Our exploit ships with a version scanner, a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
The team developed an exploit for CVE-2026-41247, a critical unauthenticated command injection to remote code execution in elFinder, an open-source web file manager that's bundled inside a wide range of CMS platforms, admin panels, and web frameworks rather than as a standalone product. The flaw lives in elFinder's image resize path and needs no authentication, so any deployment whose connector endpoint is reachable can be driven to code execution as the web server user; one precondition is that the instance uses the ImageMagick command-line back end, which is a common configuration. No in-the-wild exploitation has been reported yet, but an unauthenticated critical vuln with trivial reachability, combined with elFinder's very broad embedding across other applications, makes it a strong candidate for opportunistic mass exploitation. elFinder is almost always embedded inside a host application and its connector path varies by integration, so it presents no single reliable internet fingerprint. Our exploit ships with a version scanner, a Docker target, PCAPs, and Snort and Suricata rules.
The team developed an exploit chaining CVE-2026-41452 and CVE-2026-38526 in Webkul Krayin CRM, a self-hosted open-source CRM. On its own, CVE-2026-38526 is a critical authenticated arbitrary file upload through the bundled TinyMCE editor that yields remote code execution as the web server user, but it requires a valid account. CVE-2026-41452 removes that requirement, allowing an unauthenticated attacker to take over an account, so the two chained together turn an authenticated-only upload into a fully unauthenticated path to code execution. No in-the-wild exploitation has been reported yet, but the vuln is a strong opportunistic exploitation target. Krayin is a niche self-hosted product with a small internet footprint (a dozen or so). Our exploit ships with a Docker target, PCAPs, and Snort and Suricata detection rules.
The team also wrote an exploit for CVE-2026-68711, an unauthenticated deserialization vulnerability in ComfyUI, which is an open-source, node-based web UI for generative AI models. The software is commonly deployed locally and on cloud GPU instances as a self-hosted inference and fine-tuning platform. The vulnerability allows the user to upload a pickle payload as a .pkl file, then trigger execution via an unauthenticated REST endpoint, which results in arbitrary code execution under the context of root. No exploitation has been reported yet, and the CVE is not yet published (but is linked to this GHSA). Our exploit comes with a version scanner, PCAPs, Suricata and Snort rules, and a Docker target.
The team also added coverage for CVE-2025-29635, an authenticated command injection vulnerability in D-Link DIR823x routers. Akamai first published evidence of Mirai-associated exploitation in March of 2026, and ShadowServer reports exploitation attempts as recently as August 18, suggesting that exploitation of CVE-2025-29635 is ongoing. The DIR823x series of routers is considered end-of-life; there is no patch for this vulnerability. Our FOFA query identifies a dozen or so devices online. Coverage includes an exploit, ASM queries, network signatures, a PCAP, and a Docker target.
The team developed an exploit for CVE-2024-6825, a config injection RCE vulnerability in LiteLLM, a popular open-source AI gateway. No exploitation has been reported yet, but AI platforms and frameworks have seen significant adversary interest in 2026 so far, and six other LiteLLM CVEs are on VulnCheck KEV, including CVE-2026-40217, which the team covered in July several weeks before exploitation began. VulnCheck Target Intelligence identifies a small number of internet-exposed LiteLLM instances vulnerable to this CVE. Our exploit ships with a version scanner, a Docker target, encrypted and unencrypted PCAPs, and Suricata and Snort rules.
By customer request, the team shipped signatures this week for CVE-2025-20352, a stack overflow in the SNMP service of Cisco IOS and IOS XE, which runs on many of Cisco's switches and routers. An attacker who already holds an SNMP credential can send a single crafted request that reloads the device, causing a denial of service. If the attacker has administrative access, the same request lets them run code on the device as root. Because the vulnerability depends on existing access and delivers only a crash or a quiet foothold on the device itself, it is used as a post-access persistence step rather than a spray-and-pray remote exploit; it has been exploited in the wild by an unattributed threat actor who used it to plant a hidden implant on Cisco switches. VulnCheck Target Intelligence surfaces roughly 79,500 potentially vulnerable devices exposed to the internet. PCAPs and ASM queries are also included.