Happy Friday! Below are the Initial Access Intelligence team's deliverables for the past week. If you missed our disclosure on DARKLANTERN and SPEAKINGSTONE, two freshly discovered implants in Zbtlink routers sold worldwide, see the full story in our blog.
SPEAKINGSTONE is a VulnCheck-discovered cloud command-and-control implant shipped in the MoreQuick "MQWrt" firmware that runs as root on ZBT routers. Like ENDLESSDOORS, SPEAKINGSTONE is a fully outbound, phone-home implant that opens no listening port. It beacons over cleartext UDP to a hard-coded cloud C2 with no authentication and no transport encryption. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted the implant. Anyone who occupies the C2 position obtains root command execution on the device. The team shipped an exploit that takes that C2 / adversary-in-the-middle position, along with a version scanner, PCAP, Nuclei template, and Snort, Suricata, and YARA rules.
DARKLANTERN is a VulnCheck-discovered unauthenticated remote root command injection in infosrvd, a MoreQuick "revProto" backdoor daemon shipped in the MQWrt firmware that runs on ZBT / Zbtlink (and white-label, e.g. "Deep Orange") MediaTek routers. VulnCheck Target Intelligence identified DARKLANTERN in 22 countries worldwide, with the largest share in the United States. The team added an exploit targeting the backdoor, a version scanner, PCAP, and Snort, Suricata, and YARA rules.
This week, the team developed an exploit for CVE-2026-69414, nicknamed ShieldBreak, a Time of Check Time of Use (TOCTOU) vulnerability in Windows Defender that elevates privileges from medium integrity to SYSTEM on Windows. All exploit components (Defender, Cloud Filter, Common Log File System, and Windows error reporting) are present on Windows versions > Windows 10, making it a broadly applicable exploit. The exploit is also 100% reliable in our testing on vulnerable systems. No exploitation has been reported yet. Our exploit comes with a Sigma rule, sample log output for detection verification, and a version scanner.
The team developed an exploit for CVE-2026-73570, a critical unauthenticated OS command injection in Zimbra Collaboration Suite, an enterprise email and collaboration platform that many organizations run as their internet-facing mail server. One precondition is that the target runs Zimbra's packaged monitoring component, so an unpatched instance is not automatically exploitable. The vulnerability is actively exploited in the wild and was added to VulnCheck KEV on August 17, four days ahead of its CISA KEV listing on August 21. Shadowserver, working with CERT Polska, recorded 274 Zimbra instances already compromised with exploitation artifacts as of August 22, with the United States the most affected country. VulnCheck Target Intelligence identifies roughly 6,900 exposed Zimbra Collaboration instances. Our exploit ships with a Docker target, PCAPs, and Snort, Suricata, and Sigma rules.
The team also added an exploit for CVE-2026-76904, an unauthenticated SQL injection to RCE in GeoServer, a widely deployed open-source geospatial server. The vulnerability is a regression of the 2023 jsonArrayContains flaw (CVE-2023-25158). It needs no authentication and runs code on the server. GeoServer has a track record as a mass-exploitation target: its 2024 RCE (CVE-2024-36401) was heavily exploited in the wild, which makes a fresh unauthenticated GeoServer RCE a strong opportunistic target. CVE-2026-76904 is already being exploited: VulnCheck added it to KEV on August 21, 2026 amid reported in-the-wild activity; CISA has not yet listed it. VulnCheck Target Intelligence identifies roughly 1,100 exposed GeoServer instances online. Our exploit ships with a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
The team developed the first public exploit for CVE-2026-70558, an unauthenticated arbitrary file write in DataLinkDC Dinky, an open-source Flink SQL data-orchestration platform that manages job submission, resource files, and cluster credentials for downstream Flink deployments. There is currently no patch. The only guard on the vulnerable endpoint is a shared secret that Dinky's source ships with a hard-coded default value; the CVE reporter and the vendor both note that stock deployments rarely rotate it. A Dinky admin server holds Flink job artifacts, JAR resource paths, and the credentials Flink itself uses to reach upstream data sources, so a foothold is useful. No in-the-wild exploitation has been reported yet, but the combination of a fresh disclosure, no available fix, and a hard-coded default credential makes early scanning likely. Censys finds 80 or so exposed installations, primarily in China. Our exploit ships with a version scanner, a Docker target, a PCAP, Suricata and Snort detection rules, and ASM queries.
The team built an exploit chaining CVE-2026-39931 and CVE-2026-39932 in OpenEMR, a widely deployed open-source electronic health record and medical practice management platform. The chain carries an authenticated administrator from a backup import SQL injection to RCE via the document category tree, so an admin session (a reused or phished credential, or a weak default) becomes code execution on a server that stores protected health information. We covered this because it is a widely deployed healthcare system holding PHI that gives an attacker an admin login path to full server compromise. No in-the-wild exploitation has been reported yet, but there is some internet exposure: Shodan shows roughly 430 internet-facing OpenEMR login portals. Our exploit ships with a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
The team added an exploit for CVE-2026-40079 in Cacti, an open-source network monitoring and graphing web application built on top of RRDtool. In public, the advisory describes escape_command() as the vulnerable function, and blames __rrd_execute() for ultimately executing the malicious code. In our research we learned this analysis does not hold true for all versions. For example, 1.2.30 does not actually have the shell_exec call cited by the advisory, and there is an is_file guard that prevents the injection. Instead of relying on the advisory, our team found a more exploitable and reliable path by injecting the payload directly via a database connection, and letting the cron poller load it for execution. Cacti is widely deployed as a replacement for tools like MRTG and Nagios. VulnCheck Target Intelligence identifies around 800 internet-exposed Cacti hosts. Our exploit comes with a Docker target, a version scanner, PCAPs, and Snort and Suricata rules.
The team developed an exploit for CVE-2026-57219, a high-severity unauthenticated information disclosure in RabbitMQ's management plugin. RabbitMQ backs task queues and service-to-service messaging across a lot of production stacks, so a compromised broker is rarely the end of the story and provides a strong potential initial access vector. No in-the-wild exploitation has been reported. VulnCheck Target Intelligence identifies 2,195 internet-facing RabbitMQ instances in the vulnerable version range. Our exploit comes with a target Docker container, PCAPs, and Snort and Suricata rules.
The team also added an exploit for CVE-2026-0768 in Langflow, a popular low-code platform for building AI-powered applications and workflows. This exploit targets the code validator in the custom component editor, which suffers a critical unauthenticated RCE vulnerability. Langflow is widely deployed by developers and enterprises that want to prototype or host LLM-powered applications without writing full-stack code. Our Shodan query finds just under 2,500 internet-exposed Langflow instances. Our exploit comes with a Docker target, a version scanner, PCAPs, and Snort and Suricata rules.
The team added an exploit for CVE-2025-71333, an unauthenticated path traversal file write leading to RCE in Flowise, another popular AI framework. The stock container runs Flowise as root, so an attacker can reach code execution with full privileges in a single request. Internet-exposed AI and LLM tooling is an increasingly attractive target as these platforms move into production. The VulnCheck CNA assigned this CVE and published an advisory in June 2025. VulnCheck Target Intelligence identifies roughly 620 fingerprint-confirmed Flowise instances online. Our exploit ships with a Docker target, encrypted and unencrypted PCAPs, Suricata and Snort rules, and ASM queries.