On September 5, 2026, CERT Polska reported two vulnerabilities in the MikroTik RouterOS SSH interface being exploited in the wild. The CVEs, CVE-2026-67279 and CVE-2026-86060, collectively known as "MikroTrick," allow an unauthenticated, remote attacker to gain an administrative session without credentials. MikroTik has historically been popular with small ISPs and WISPs, making them a high-value target that advanced threat actors have abused over the years.
Our team developed exploits for the two MikroTrick CVEs as well as the related CVE-2026-67276, along with a vulnerable Docker container, a PCAP, a Sigma rule, a YARA rule, and ASM queries. Currently, our Target Intelligence scanner notes ~70,000 active RouterOS SSH servers on the internet.
Both CVEs, CVE-2026-83548 and CVE-2026-83549, landed on VulnCheck KEV the same day SonicWall published them, with the vendor confirming active exploitation in the wild. The affected devices are SonicWall SMA1000 Series secure remote access appliances (SMA8200v, SMA6210, SMA7210). Our Censys queries show approximately 1,600 potentially exposed devices.
Our exploit ships with the usual encrypted and decrypted PCAPs, Suricata and Snort rules, and ASM queries.
Ubiquiti's UniFi ecosystem is one of the most widely deployed networking platforms in the SMB and prosumer space, and UniFi OS consoles are internet-facing by design. Attackers know this: a similar CVE, CVE-2026-34910, has seen daily exploitation on ShadowServer for months.
CVE-2026-77550 is an authentication bypass in that same attack surface. No public proof of concept currently exists, but exploitation is likely to follow once one surfaces. Our Target Intelligence scanner currently surfaces just short of 100,000 Ubiquiti UniFi interfaces.
Our exploit ships with a Docker target, encrypted and unencrypted PCAPs, Suricata and Snort rules, a Sigma rule, a YARA rule, and ASM queries.
As mentioned above, UniFi is wildly popular and UniFi Protect is Ubiquiti's video surveillance controller. You wouldn't expect this to be internet-facing, but our Shodan query shows over 5,000 instances. No public details currently exist for CVE-2026-77537. When they do surface, the bug class (command injection) makes exploitation likely to follow quickly. Ubiquiti's advisory is vague enough that it wouldn't get you there on its own; our team found the vector through code auditing.
Our coverage includes an exploit, a Docker target, PCAPs, Snort, Suricata, and YARA rules.
CVE-2025-60710 was added to both VulnCheck and CISA KEV on April 13, 2026, with confirmed use in ransomware campaigns. It's a local privilege escalation in the SYSTEM scheduled task behind Windows Recall's policy cleanup. Our exploit goes past a bare delete primitive, chaining the bug into a Windows Installer rollback-script hijack to land full code execution as SYSTEM.
As this is a local privilege escalation, there are no ASM queries, network rules, or PCAPs. Our exploit ships with a version scanner and a Sigma rule.
CVE-2026-18963 was added to VulnCheck KEV on August 25, 2026, after Pervidian reported exploitation attempts against their Keycloak honeypots. Keycloak is a widely deployed open-source identity provider that backs single sign-on for other applications, so a bypass in its own account-recovery flow opens a direct path into whatever sits behind it. VulnCheck Target Intelligence identifies more than 7,000 internet-facing Keycloak instances.
Our exploit ships with a Docker target, encrypted and unencrypted PCAPs, Suricata and Snort rules, and ASM queries.
CVE-2026-82329 was first reported as being exploited in the wild by Watchtowr on September 1, 2026, and subsequently added to CISA KEV on September 2. Public exploits have been available since at least September 1, and despite the low number of deployments, honeypot providers like GreyNoise continue to see exploitation attempts.
Our exploit ships with a Docker target, encrypted and unencrypted PCAPs, Suricata and Snort rules, a YARA rule, and ASM queries.
CVE-2023-54391 is a single-request, unauthenticated authentication bypass in Proxmox VE, and our Target Intelligence identifies roughly 71,000 internet-facing instances. VulnCheck is the CNA for this CVE. The upstream fix shipped in 8.0.4 back in 2023 as a side effect of an unrelated patch, but it was never backported, leaving the entire 7.x line (now EOL) silently exposed until VulnCheck cataloged it.
Our exploit ships with a Docker target, encrypted and unencrypted PCAPs, Suricata and Snort rules, a Sigma rule, a YARA rule, and ASM queries.
These four vulnerabilities were discovered by team member Valentin Lobstein (Chocapikk) and detailed in a VulnCheck blog post. FileRun is a self-hosted file management and sharing platform that organizations run as a private cloud drive. VulnCheck Target Intelligence identifies more than 150 internet-facing FileRun instances.
Our exploits ship with Docker targets, encrypted and unencrypted PCAPs, Suricata and Snort rules, and ASM queries.
CVE-2026-52806 was added to VulnCheck KEV on June 28, 2026 due to Wiz's publication of a cryptojacking campaign. Gogs is a self-hosted Git service that ships with open registration enabled by default, so a stock instance is effectively open to anyone. VulnCheck Target Intelligence identifies more than 1,300 internet-facing Gogs instances.
Our exploit ships with a Docker target, a PCAP, a version scanner, Snort, Suricata, and Sigma rules, and ASM queries.
CVE-2026-75754 is an unauthenticated RCE in ASUS Control Center, an IT infrastructure management platform, that drew security media attention despite the lack of a public proof of concept. The value of the target is the pivot opportunity: compromising the management server gives an attacker a path to every downstream device it manages. Our FOFA query currently shows approximately 50 instances on the public internet.
Coverage includes an exploit, a version scanner, PCAPs, and ASM queries.
The team also added historical coverage for CVE-2022-1471 and CVE-2024-21534, two library vulnerabilities, as part of ongoing breadth and depth work.