This week, the team added an exploit for CVE-2026-8452, a critical heap overflow in the SAML canonicalization code of Citrix NetScaler ADC and Gateway. Citrix's advisory frames the vulnerability as denial of service only, but this is incorrect, as originally noted by watchTowr. VulnCheck's exploit takes that research further by developing fully functional exploit code, removing the dependency on hard-coded constants derived from NetScaler's firmware, and delivering broader unauthenticated RCE as root across both the 14.1 and 13.1 branches. Exploitation was reported in the wild on August 17, 2026, the day the CVE hit VulnCheck KEV; CISA followed nine days later. The only public exploit does not work as published even on the build it was written for, which we confirmed on a live appliance. VulnCheck Target Intelligence and popular ASM engines find tens of thousands of exposed NetScaler Gateways, though a smaller number are likely to have SAML configured. Our exploit comes with a version check, PCAPs, a Suricata rule, a YARA rule, and ASM queries.
The team developed an exploit for CVE-2026-81578 and CVE-2026-82078 in PaperCut NG and MF that map respectively to an access control bypass vulnerability and a code execution vulnerability via Unsafe Dynamic Class Loading. The chain was disclosed amid zero-day exploitation, per the vendor and Huntress. VulnCheck KEV added both CVEs on August 28, 2026, three days ahead of CISA KEV. VulnCheck Target Intelligence finds at least 1,200 internet-exposed PaperCut instances after heavy de-duplication and honeypot filtering. Our exploit ships with a version scanner, PCAPs, Suricata and Snort rules, a YARA rule, and ASM queries.
The team built an exploit chaining CVE-2026-63219 and CVE-2026-58400 in OSGeo GeoNetwork, the open-source geospatial metadata catalog behind many Spatial Data Infrastructure deployments. Exploitation allows the attacker to run commands as the GeoNetwork process user (root in the official Docker image). The whole chain is unauthenticated and lands code execution in a single flow. Both vulns are already being exploited: VulnCheck added them to KEV on September 3, 2026. CISA has not yet listed them. The team's ZoomEye query returns around 450 internet-facing instances, roughly 235 observed within the past year, mostly in Australia. Our exploit ships with a Docker target, PCAPs, Suricata and Snort rules, and ASM queries.
The team developed an exploit for CVE-2026-9586, an unauthenticated SQL injection leading to command execution in Sangoma Switchvox, an on-prem IP PBX and unified-communications appliance. It runs commands on the appliance in a single request, and Switchvox sits at the network edge as an internet-facing voice system, which makes a pre-auth RCE a high-value initial access target. The vulnerability, which was discovered by Horizon3, is already being exploited. It was added to VulnCheck KEV on September 1, 2026, and to CISA KEV a day later. A Shodan search for http.html:"switchvox.util.browserChecker" returns roughly 4,200 internet-facing instances. Our exploit ships with a Docker target, PCAPs, Suricata and Snort rules, and ASM queries.
The team developed an exploit chaining CVE-2026-71960 and CVE-2026-71961 in the Cudy WR3000 and P5, consumer Wi-Fi routers running Cudy's OpenWrt-based firmware. These routers expose an MQTT broker whose authentication rests on a JWT secret hard-coded into every unit (CVE-2026-71960), so an attacker mints a valid token and connects with no credentials. A root-privileged agent behind the broker then passes an attacker-controlled command to a shell (CVE-2026-71961), delivering code execution as root. No in-the-wild exploitation has been reported yet. VulnCheck published an advisory covering the authentication bypass. A ZoomEye search for the panel's copyright footer and login script returns about 13,400 internet-facing Cudy panels, roughly 11,500 of them observed within the past year. Our exploit ships with a Docker target, a PCAP, Suricata and Snort rules, and ASM queries.
The team added an exploit for CVE-2026-34980, an unauthenticated RCE vulnerability in OpenPrinting CUPS, the default printing subsystem across nearly every Linux and Unix system. An anonymous attacker can submit a crafted print job to a network-shared PostScript queue and run an attacker-chosen command as the lp service user, with no credentials. A public advisory and PoC were published on April 5, 2026. No in-the-wild exploitation has been reported yet. There is a precondition for exploitation: the target must expose cupsd over the network and share a legacy PostScript queue. Shodan finds 61K+ CUPS instances exposed to the internet. Our exploit ships with a version scanner, a Docker target, a PCAP, Snort and Suricata rules, and ASM queries.
The team also developed another exploit for CUPS targeting CVE-2026-34990. The vulnerability is a local privilege escalation that allows an unprivileged local user who can reach cupsd over its loopback socket to make the root scheduler disclose its own admin token and then drive a root-owned arbitrary file write, escalating to full root. Given that CUPS is borderline universal on Linux, this is a high-value escalation step for any attacker who already has a foothold. Notably, it works against a stock CUPS configuration (with the FileDevice option left disabled), not just hosts that have opted into file printing. No in-the-wild exploitation has been reported yet. Notably, the team found that many distributions backport the fix without changing the reported version string, so an in-range version is only ever reported as possibly vulnerable. Because the escalation happens over cupsd's local Unix socket, there is no network traffic to signature; our exploit comes with a version scanner and a Docker target.
The team also developed an exploit for CVE-2026-33453, an unauthenticated RCE flaw in Apache Camel, a widely used open-source integration framework. Successful exploitation allows an adversary to run an arbitrary command with the service's privileges. CoAP is unauthenticated and its DTLS layer is off by default, so nothing at the HTTP layer sees the request. Exploitation requires a route that binds camel-coap to a header-sensitive producer, so an exposed CoAP endpoint is not automatically vulnerable. No in-the-wild exploitation has been reported yet. Our exploit ships with a Docker target, PCAPs, and Suricata and Snort rules.
The team added an exploit for CVE-2026-41315, an unauthenticated command injection leading to root code execution in Midoks Mdserver-Web, an open-source Linux server management panel that runs as root. In versions 0.18.0 through 0.18.4, the crontab management routes are missing their authentication check, so an attacker can hijack a scheduled task and run commands as root. No in-the-wild exploitation has been reported yet. The team's Shodan query returns 106 internet-facing instances. Our exploit ships with a Docker target, a version scanner, encrypted and unencrypted PCAPs, Suricata and Snort rules, and ASM queries.