This week, the team added exploit and detection coverage for more than 140 unique CVEs, several of which saw VulnCheck Canary exploitation almost immediately after being deployed. Coverage this week spans a slew of routers, AI tooling, ICS and SCADA platforms, widely used libraries, and popular open-source projects. Highlights are below. For full coverage details, see the Initial Access Intelligence API.
The team developed an exploit for CVE-2026-111497, an out-of-bounds write in Google’s Brotli streaming decoder that is reachable through Node.js wherever an application decompresses Content-Encoding: br request bodies. A remote, unauthenticated attacker can stream a crafted Brotli body that drives the decoder into writing past the end of its read buffer, crashing the Node.js process. The team shipped both a DoS variant and an RCE variant of this exploit; the vulnerability was added to VulnCheck KEV and CISA KEV on October 26 and 27, respectively, but we assess that ASLR will mitigate the risk of exploitation for RCE on most systems. Our exploit comes with PCAPs, Snort and Suricata rules, and a target Docker container.
The team developed an exploit for the Adobe Experience Manager pre-authentication RCE chain disclosed by Searchlight Cyber, combining CVE-2026-48252, CVE-2026-48263, and CVE-2026-48359. AEM is a widely deployed enterprise CMS fronting major brand sites, and the chain reaches code execution on the author with no credentials: an unauthenticated write and an XXE steal the service-account key, which forges an IMS token into a Groovy execution sink. No in-the-wild exploitation is reported yet. VulnCheck Target Intelligence sees roughly 5,600 internet-facing Adobe Experience Manager instances. Our exploit comes with a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
The team added an exploit for CVE-2026-44193, a command-injection-to-root flaw in the OPNsense firewall's XMLRPC configuration-restore interface. We covered it because any account holding the single "XMLRPC Library" privilege gains root code execution on the firewall itself. No in-the-wild exploitation has been reported. VulnCheck Target Intelligence finds a little over 34,000 internet-facing OPNsense service records. Our exploit ships with PCAPs, Snort and Suricata rules, and ASM queries.
By request, the team developed an exploit for CVE-2026-86360, a critical zip-slip path traversal in Dell System Update (DSU) that results in remote code execution as SYSTEM. Dell is a near-universal fixture in enterprise environments, and DSU is the standard update mechanism for their hardware fleet. No in-the-wild exploitation has been reported yet. Our exploit ships with a Docker target and a Sigma rule.
The team developed an exploit for CVE-2026-93489, an authentication bypass in ASUS router firmware, reproduced on the RT-AX86U Pro. We covered it because an adjacent attacker with no credentials can forge an administrator access token at the router's mobile-app token endpoint, then enable SSH, inject a key, and land a root shell on a consumer router line running on millions of home and small office networks. No in-the-wild exploitation has been reported yet. The one precondition is that a device must have previously paired with the ASUS mobile app. VulnCheck Target Intelligence sees roughly 5,400 internet-facing RT-AX86U Pro service records. Our exploit ships with a Docker target, an unencrypted PCAP, Snort and Suricata rules, and ASM queries.
The team chained three flaws in the Advantech ADAM-3600 EdgeLink industrial RTU: a forgeable web session token (CVE-2026-43844), embedded default administrator credentials (CVE-2026-43845), and an authenticated command injection (CVE-2026-43850). EdgeLink gateways sit at the OT/IT boundary of SCADA deployments, and the chain reaches a root shell with no credentials end to end against factory-default or reset units — an attractive target for ICS-focused intruders. Our exploit ships with a Docker target, encrypted and unencrypted PCAPs, Snort and Suricata rules, and ASM queries.
The team developed an exploit for a missing authentication vulnerability (CVE-2025-41656) in Node-RED, a low-code tool for wiring together hardware devices, APIs, and online services running at the edge or in the cloud. It does not configure authentication by default, so an unauthenticated attacker can run arbitrary commands with high privileges. VulnCheck Canaries observed exploitation on October 30, 2026, four days after we covered the flaw; it was added to VulnCheck KEV the same day. It is not yet on CISA KEV. No other public or commercial exploits exist for this vulnerability. Our exploit ships with a version scanner, a Docker target, PCAPs, Suricata and Snort rules, and ASM queries.
We also added net-new coverage this week for various other vulnerabilities that quickly began seeing VulnCheck Canary exploitation, including: