At The Edge Clear: September 14 – 21, 2026
Summary: In the September 14-21, 2026 analysis period, GreyNoise saw attempts against CVE-2022-22963 in Spring Cloud Function (CVSS 9.8, in CISA's Known Exploited Vulnerabilities catalog) and CVE-2018-17246 in the Elastic Kibana console jump from single-digit daily sources to several hundred in one day, and neither had come back down when collection closed. A Sophos Firewall authentication bypass recorded as subsided in April returned at roughly sixty times the prior period's daily rate, with 67 malicious sources in the final 24 hours, and a single address on a rented hosting range ran all three in the same hours.
Bottom line: One host on a rented range ran all three flaws in a single pass, so the Sophos bypass - which reaches code execution on the appliance enforcing the perimeter with no credential - is a patch-verification problem, not a volume-alerting one. Detection keyed to failed logins sees only a sliver of the pressure, since manager-interface scanning outran credential attack behavior by better than an order of magnitude.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-17246CVE-2022-1040CVE-2022-22963
- Related
- CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Aug 25, 2022CVE-2022-1040: Sophos Firewall Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Mar 31, 2022Threat Advisory: Spring4Shell Cyber Risks ·