Grey Noise Releases 2026 State of the Edge Report

Summary: GreyNoise analyzed 2.97 billion sessions over 162 days in H2 2025 and found Palo Alto GlobalProtect drew 16.7 million sessions, more than 3.5x Cisco and Fortinet combined. The report also found 52% of remote code execution attempts came from IPs with no prior GreyNoise history, pre-2015 CVEs generated 7.3 million sessions (4x more than 2023-2024 CVEs combined, mostly CVE-1999-0526), and a single credential-spraying campaign involved 300,000 residential IPs, 73% classified as residential by ISP categorization.
Why it matters: More than half the IPs attempting remote code execution had no prior record, so static threat feeds and reputation scoring would have missed them entirely - and a 26-year-old X Server flaw still outpaces recent CVEs 4 to 1, which means a patching program optimized for recency leaves the bulk of this traffic unaddressed.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-1999-0526
Related: Grey Noise Releases 2026 State of the Edge Report: More Than Half of Remote Code Execution Attempts Originate From Previously Unseen IPs Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026