At The Edge Clear: July 06 - 13. 2026
Summary: GreyNoise's early-warning detection flagged validated late-week spikes against FortiOS SSL VPN (CVE-2018-13379, a CISA KEV), Cisco SSL VPN, Ivanti EPMM, and NETGEAR devices during the July 06 to July 13, 2026 analysis period. Beneath those spikes, one DIGI VPS host (103.168.66.158) ran file-inclusion exploits including ThinkPHP (CVE-2022-47945, CVSS 9.8), two VPSVAULT hosts on 45.198.224.0/24 ran roughly 665,000 RouterOS Bruteforcer attempts against the MikroTik management API on TCP/8728, and nine hosts on 91.238.181.0/24 ran coordinated RDP scanning and brute-force.
Why it matters: GreyNoise notes that elevations of this kind have historically preceded new vendor vulnerability disclosures, so the FortiOS, Cisco, Ivanti, and NETGEAR spikes may be a warning of exploitation still to be disclosed. The 665,000 RouterOS attempts involved no CVE at all - pure valid-credential discovery against a management API often left internet-facing.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-13379CVE-2022-47945
- Related
- CVE-2018-13379: Fortinet FortiOS SSL VPN Path Traversal Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021