This week, the team added exploit and detection coverage for 200+ unique CVEs, including three that saw VulnCheck Canary exploitation and were added to VulnCheck KEV for the first time. Highlights from this week are below. For full coverage details, see the Initial Access Intelligence API.
The team developed an exploit for CVE-2026-73695, an unauthenticated remote code execution flaw in the user panel of Control Web Panel (CWP, formerly CentOS Web Panel), chained with CVE-2026-73696 and flaws in the panel's root-owned internal API to reach root. These vulnerabilities are part of a larger batch of 10 CVEs in Control Web Panel that were discovered and disclosed by VulnCheck's own Valentin Lobstein this week. Full details are in our disclosure blog. None of the newly disclosed vulnerabilities are known to be exploited yet.
The CWP user panel is a recurring initial access vector: CVE-2025-48703 on the same surface was exploited in the wild and added to VulnCheck KEV on August 15, 2025, and the new chain remained effective after that earlier flaw was fixed. VulnCheck Target Intelligence identifies 118,000+ internet-facing CWP services, including 19,800+ on the 2083 user-panel port. Our exploit ships with a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
The team also developed an exploit for CVE-2026-118633, a pre-authentication path traversal in the Sophos UTM email proxy. We covered it because it yields code execution as root with no credentials on an internet-facing mail gateway: when antivirus scanning is enabled, the root-owned content scanner derives MIME temp file paths from the message's Message-ID, so a traversing message ID drops an attacker-controlled /etc/cron.d entry that cron runs as root. Sophos rates every Sophos UTM version as affected, and the product is end-of-life, fixed only by a manual patch. VulnCheck Target Intelligence finds about 150 internet-facing Sophos UTM instances. Our exploit ships with a PCAP, Snort and Suricata rules, and ASM queries.
The team added an exploit for CVE-2026-21654, an unauthenticated OS command injection in the Johnson Controls / Frick Quantum HD, a legacy industrial refrigeration controller. A single unauthenticated HTTP request to the controller's HMI runs commands on the device with no credentials (as root on the physical unit), the kind of pre-auth foothold on an internet-exposed OT device that attackers reuse at scale. It was disclosed by Claroty Team82 and highlighted in a CISA ICS advisory from February 2026; no in-the-wild exploitation has been reported yet. Our exploit ships with a version scanner, a Docker target, PCAPs, Snort and Suricata rules, and ASM queries.
The team developed an exploit for CVE-2026-76443, an unauthenticated SQL injection in S/MIME Public Key Harvesting that executes commands as root over SMTP when the feature is enabled. We reproduced root execution on AsyncOS 15.5.4-012; the SMTP service fingerprints the appliance but cannot remotely confirm its build or harvesting policy. VulnCheck Target Intelligence reports eight internet-facing records associated with the CVE, though that does not confirm the feature is enabled. Our exploit ships with PCAPs, Suricata rules, and ASM queries.
Finally, the team added an exploit for CVE-2026-75650, a pre-authentication RCE in Adobe Commerce and Magento. Attackers were exploiting the flaw before Adobe's emergency hotfix, and compromise of a payment platform puts encryption keys, payment credentials, API tokens, and connected systems at risk. VulnCheck KEV added it on September 7, one day before CISA KEV. VulnCheck Target Intelligence reports 4,487 internet-facing Magento service records; exposed versions and hotfix status cannot be confirmed remotely. Our exploit ships with a Docker target, encrypted and unencrypted PCAPs, Snort and Suricata rules, and ASM queries.
We also added net-new coverage this week for three CVEs that quickly started seeing first-time (ever) exploitation evidence in VulnCheck's Canary Intelligence network: