At The Edge Clear: September 8 – 14, 2026
Summary: GreyNoise recorded adversaries attempting two CISA Known Exploited Vulnerabilities remote code execution flaws in the AI application platform Langflow, CVE-2025-3248 and CVE-2026-0770, at 3,968 and 4,770 connection attempts during September 8-14, 2026. Every address seen on either flaw also carried a generic web crawling tag, roughly nine in ten collected environment files and enumerated WordPress installations, and about four in five requested repository configuration, with two hosting providers supplying roughly 95% of those addresses.
Why it matters: One address supplied 56% of all Remote Desktop crawling GreyNoise observed and three fifths of the credential attempts inside it, yet those attempts ran just 3.6% of what that source sent - so a detection keyed to failed logins sees only a fraction of the pressure.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-3248CVE-2026-0770
- Related
- CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability Known Exploited Vulnerabilities · Jul 21, 2026CVE-2025-3248: Langflow Missing Authentication Vulnerability Known Exploited Vulnerabilities · May 05, 2025Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026