Happy Friday! The Initial Access Intelligence team shipped fresh exploits, detections, queries, and more for 50+ CVEs this week, with more rolling into the feed as we type. For full details, please see the Initial Access API. Highlights from this week are below.
This week, the team developed an exploit for CVE-2026-93616, a critical path traversal and file upload vulnerability in Check Point's Quantum and Multi-Domain Security Management servers. Check Point disclosed the vuln as a zero-day that was exploited in July 2026, roughly two months before a fix was available. Our exploit needs no credentials and no prior access. No public proof-of-concept exploit has been published, so despite the confirmed in-the-wild use, defenders have had nothing to reproduce the attack against until now.
VulnCheck Target Intelligence identifies roughly 3,150 internet-facing Check Point management servers. Our exploit ships with a version scanner, PCAPs, Snort and Suricata rules, a YARA rule, and ASM queries.
The team also added an exploit for CVE-2026-21589, an unauthenticated arbitrary file read affecting the full Atlassian Data Center lineup: Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, and Jira. We covered it because it is a trivial, pre-auth initial access vector, disclosed out-of-band by Atlassian on October 5, 2026 and quickly picked apart by watchTowr. The advisory frames the impact as limited to reading known files under the web root, but when Atlassian Crowd is part of the deployment, a single request yields a plaintext administrator username and password. No in-the-wild exploitation has been reported yet, but Atlassian products have a long history of mass exploitation once a pre-auth bug is public, so we expect interest to follow. VulnCheck Target Intelligence sees thousands of internet-facing Atlassian instances across the affected products, including roughly 8,700 Confluence and 5,400 Jira servers.
Our exploit ships with a version scanner, a Docker target, encrypted and unencrypted PCAPs, Snort and Suricata rules, a YARA rule, and ASM queries.
The team developed an original exploit for CVE-2026-104286, a critical unauthenticated file write vulnerability in Fortinet FortiMail, a popular enterprise email security gateway. The vulnerability, which gives an attacker unauthenticated root code execution on the box, was disclosed as a zero-day on October 1, 2026, with known in-the-wild exploitation. VulnCheck Target Intelligence identifies roughly 6,400 internet-facing FortiMail instances. No other public or commercial exploits exist as of today. Our exploit ships with PCAPs, Snort and Suricata rules, and ASM queries.
The team wrote an exploit for CVE-2026-97229, an unauthenticated RCE vulnerability in GitLab. The vulnerability nominally needs an account to exploit, but our exploit registers its own throwaway account when signup is open, so a stock instance needs no supplied credentials; code runs as the GitLab service user, the unprivileged git user on the official images. A self-hosted DevOps platform exposed to the internet is a high-value foothold: source code, CI secrets, and SSH keys in one place, plus a path into the software supply chain, which is why we covered it. No in-the-wild exploitation has been reported yet. VulnCheck Target Intelligence identifies more than 39,000 internet-facing GitLab instances. Our exploit ships with asset detection, a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
The team added an exploit for CVE-2026-66804, a high-severity elevation of privilege vulnerability in Windows 11 that allows a standard user to gain code execution as NT AUTHORITY\SYSTEM without administrative credentials or special permissions. Google Project Zero published this as the result of an incomplete fix for CVE-2026-50343. No in-the-wild exploitation has been reported. Because the attack runs through COM infrastructure and local disk writes rather than the network, detection is host-based only. Our exploit ships with a version scanner and a Sigma rule.
The team developed an exploit chaining CVE-2026-105133 and CVE-2026-105134 for unauthenticated RCE in Ahsay AhsayCBS, a server-side console MSPs and enterprises run to manage client and offsite backups. It runs code as root on the official Linux images, which is why we covered it: a backup server holds copies of an organization's data and reaches broadly into its network. It was added to VulnCheck KEV after Huntress reported in-the-wild exploitation to drop JSP webshells and cryptominers. Our exploit ships with a Docker target, a PCAP, and Snort and Suricata rules.
By customer request, the team developed an exploit for CVE-2025-7775, an unauthenticated buffer overflow in the Common Gateway Protocol request reassembly path of Citrix NetScaler ADC and Gateway that yields remote code execution. Our exploit leverages a heap poisoning attack to gain code execution, but because we have little control over the target heap, it is low-reliability and therefore usually requires multiple attempts in order to succeed. Unlike more recent NetScaler vulnerabilities (e.g., CVE-2026-88771, CVE-2026-88772), CVE-2025-7775 has gone largely unresearched since Citrix disclosed it amid zero-day exploitation in August of 2025. Our exploit ships with a version scanner, PCAPs, Suricata and Snort rules, and ASM queries. VulnCheck Target Intelligence finds roughly 50,000 internet-facing NetScaler Gateway and NetScaler ADC instances.