Happy Friday! The following are the Initial Access Intelligence team's riot of deliverables for the past week.
This week, the team added a first-to-market exploit for CVE-2026-85102, a critical improper certificate validation vulnerability in Check Point Security Gateway and Spark Firewall. Check Point confirmed directly that exploitation attempts began against Spark customers worldwide a day after the issue was disclosed. The vendor advisory describes the impact as arbitrary code execution on the gateway, but our team instead leveraged the authentication bypass to obtain a valid VPN tunnel against an affected target. Exploitation requires the username of a user with certificate authentication enabled. VulnCheck Target Intelligence finds between 70K and 80K Check Point firewalls online.
Our exploit ships with a PCAP and ASM queries. No network rules exist for this vulnerability: Neither Snort nor Suricata can determine whether a submitted chain actually anchors to a trusted CA, and every metadata fingerprint we considered could collide with legitimate authentication attempts.
The team also developed another first-to-market exploit chaining CVE-2026-76460, a critical (CVSS 10.0) unauthenticated credential-disclosure bug in Cisco Identity Services Engine, with CVE-2026-20176, a command injection that Cisco's advisory says requires high-privileged administrative credentials. CVE-2026-76460 was added to both VulnCheck KEV and CISA KEV on September 16, 2026. Neither advisory names any technical details, but our team reverse engineered the full chain against a live lab target, providing first-to-market coverage on these bugs. VulnCheck Target Intelligence identifies a small (10 or so) number of internet-facing Cisco ISE instances. Our exploit ships with PCAPs, Suricata and Snort rules covering both the credential disclosure and the command injection, a YARA rule for the injection's log signature, and ASM queries.
The team added queries and Suricata and Snort rules for CVE-2026-94127, a heap-based buffer overflow vulnerability in F5 BIG-IP's Access Policy Manager (APM) that made news this week after it was disclosed amid vendor-confirmed exploitation. VulnCheck Target Intelligence finds 108,000+ F5 BIG-IP instances online. Our team will work on an exploit for this CVE next week.
The team added a first-to-market exploit for CVE-2026-30633, a path traversal in knowns (an npm-distributed AI-agent knowledge and memory tool) that lets an unauthenticated attacker escape the managed document roots to both read and write arbitrary files on the host. This is the same insecure agent tooling pattern we keep seeing as MCP-style frameworks ship file operations without guardrails, which is why we prioritized coverage. VulnCheck's Canary Intelligence network began detecting exploitation on September 24, 2026, when the flaw was added to VulnCheck KEV; new hits are still rolling in today (September 25). Our exploit ships with a Docker target built from the real package-installed binary, an unencrypted PCAP, and Snort and Suricata rules.
The team added an exploit for CVE-2026-30632, a path traversal in knowns that lets an unauthenticated attacker write files outside the managed document roots. Agent tooling like knowns is being wired into developer and enterprise workflows faster than it is being hardened, and an arbitrary file write primitive in that layer is a direct path from a single exposed endpoint to persistence or configuration tampering. No in-the-wild exploitation has been reported yet, and there are no other exploits or PoCs at time of writing. Our exploit ships with a Docker target built from the real package-installed binary, PCAPs, and Snort and Suricata rules.
The team developed an exploit for CVE-2026-87902, an unauthenticated local file inclusion in WordPress core that turns into RCE on a common class of installs. When register_argc_argv is enabled and pearcmd.php is present — the default on the official PHP Docker images and on cPanel below PHP 8.5 — the file inclusion becomes code execution as the web server user. It affects WordPress 4.7.0 through 7.1.1 and is fixed in 7.1.2, which WordPress backported to every branch down to 4.7. VulnCheck added it to our KEV on September 22, 2026, the day it was disclosed. It is not yet on CISA KEV. VulnCheck Target Intelligence finds roughly 180,000 internet-facing WordPress instances. Our exploit ships with a Docker target, encrypted and unencrypted PCAPs, Suricata and Snort rules, a YARA rule, and ASM queries.
The team developed an original exploit for CVE-2026-43641, a critical unauthenticated OS command injection in Virtualizor, Softaculous' commercial VPS and hypervisor control panel. The vulnerability was found and disclosed by VulnCheck's own Valentin Lobstein. Because Virtualizor's web layer runs as root to provision and manage KVM/OpenVZ/LXC guests, the flaw yields code execution as uid=0 on the hypervisor node itself, not a confined web account, so a single compromised panel hands over every VM on the box. No in-the-wild exploitation has been reported yet. VulnCheck Target Intelligence identifies 112 internet-facing Virtualizor instances. Full details are available in our disclosure blog. Our exploit ships with a Docker target, encrypted and unencrypted PCAPs, Snort and Suricata rules, and ASM queries.
The team also added an exploit for CVE-2026-74480, a double-free local privilege escalation in the Linux kernel's bridge multicast snooping code. The vuln needs no credentials and no network position, so it is a reliable escalation primitive on top of any initial foothold: a compromised service account, a container breakout, or a shell from one of our remote access exploits turns into full root. It was validated against RHEL 10.2 and AlmaLinux 10.2 (kernel 6.12.0-211.7.3.el10_2), and it resolves the kernel symbols, ROP gadgets, and struct offsets from the target's own /boot artifacts at runtime instead of hard-coding them, so it is not pinned to a single build. Our exploit ships as a self-contained Go binary with a check for the affected kernels; as a local escalation with no network footprint, it has no PCAPs, detection rules, or ASM queries.
The team developed an exploit for CVE-2026-0770, a critical unauthenticated RCE vulnerability in Langflow, which regular readers might be sick of hearing about since it's been such a frequent target recently. This class of sandbox-escape-by-default is representative of broader AI-related exposures that attackers are turning into footholds. VulnCheck added it to its KEV on February 14, 2026. VulnCheck Target Intelligence identifies 184 internet-facing Langflow instances. Our exploit ships with a Docker target built from the real application source, unencrypted PCAPs, and Snort and Suricata rules.
The team developed an exploit for CVE-2026-81735, a critical unauthenticated RCE flaw in the mcp-http-server component of ByteDance's UI-TARS-Desktop, an open-source GUI-agent desktop application. We covered it because MCP servers are fast becoming a first-class attack surface as AI-agent tooling spreads into developer and enterprise environments, and this insecure-by-default binding is the kind of exposure that many defenders are not yet inventorying. Notably, the fix landed in a single commit while the package version stayed at 1.2.4, so version-based inventory alone won't tell an operator whether they're patched. No in-the-wild exploitation has been reported yet. Our exploit ships with a Docker target built from the real application source, PCAPs, and Snort and Suricata rules.
The team developed an exploit for CVE-2026-52869, an authorization bypass in the MCP Python SDK, the reference mcp PyPI package that a large share of Model Context Protocol servers are built on. Its SSE and streamable-HTTP transports route requests to a session using only the caller-supplied session ID and never verify that the authenticated bearer token matches the principal that opened the session, so a client with a different token but a known session ID can inject JSON-RPC calls into another user's session and read its context and tool output. We covered it because the flaw lives in the SDK itself rather than in any one server, so it weakens every multi-tenant MCP deployment built on the affected versions. No in-the-wild exploitation has been reported yet. Our exploit ships with a Docker target built from the real package-installed binary, an unencrypted PCAP, and Snort and Suricata rules.
The team developed an exploit for CVE-2026-90898, a critical unauthenticated RCE vulnerability in Bifrost (Maxim's open-source AI gateway) that allows a single unauthenticated request to run an arbitrary command as the gateway process user (uid 1000 on the official image, not root). AI gateways are becoming core routing infrastructure for LLM and agent traffic, and an insecure-by-default management API at that layer turns a reachable endpoint into control over an organization's model access. No in-the-wild exploitation has been reported yet. Our exploit ships with a Docker target, encrypted and unencrypted PCAPs, Snort and Suricata rules, and ASM queries.
The team developed an exploit for CVE-2026-53710, a maximum-severity unauthenticated RCE vulnerability in IBM MCP Context Forge, IBM's AI gateway for MCP and other APIs. On the affected sample server's HTTP transport, anyone who can reach it gets code execution as root on the reference container with no credentials. It is not on any KEV list and no in-the-wild exploitation has been reported, but we expect that to change as this product class spreads. Our exploit ships with a Docker target, PCAPs, Suricata and Snort rules, and ASM queries.
The team developed an exploit for CVE-2026-27626, a command injection vulnerability in OliveTin, a self-hosted web application that provides a browser-based interface for running predefined shell commands. A successful attack results in arbitrary command execution as the olivetin user. ASM query results range from under 100 to 400+, with the highest concentration in North America. No exploitation has been reported yet. Our exploit ships with a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
Finally, the team developed an exploit for CVE-2026-48611, an authentication bypass in phpBB that allows anyone to gain administrator access to the application. The vulnerability affects both phpBB 3 and phpBB 4 in their default configuration. On vulnerable installs of phpBB 4.0, a new feature makes it possible for an attacker to install a malicious extension remotely. In this case, we use it to provide a webshell which allows the attacker to run arbitrary commands as the user www-data. The exploit comes with a PCAP, version scanner, Suricata and Snort signatures, ASM queries, and a target Docker.