At The Edge Clear: August 23 - 30, 2026
Summary: GreyNoise's August 23-30, 2026 analysis period recorded daily unique sources against the Next.js authorization bypass CVE-2025-29927 rising from no more than three to 28, then 426, then 495 across a partial final day, with the population still climbing when the window closed. On August 30, source sets of matched size appeared on eight of nine legacy Citrix flaws across SD-WAN appliances, XenMobile Server and ShareFile StorageZones, and 96 rented hosts on four networks running one scanning toolkit produced roughly a tenth of all traffic observed.
What you should know: CVE-2025-29927 is rated CVSS 9.1 and is absent from CISA KEV, and six of the nine Citrix flaws carry no CVSS score at all, so a severity-ordered queue never surfaces them; the single-day cohorts never sustain enough volume to cross a rate threshold, and a control scoped to any one of the four networks covers less than half of the 96-host activity.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-12989CVE-2025-29927CVE-2025-55182
- Related
- CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025CVE-2019-12989: Citrix SD-WAN and Net Scaler SQL Injection Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022