At The Edge Clear: June 15 - 23, 2026
Summary: GreyNoise reported that distinct sources brute-forcing Cisco SSL VPN portals jumped to 3,645 on June 23, 2026, from double digits a week earlier, with a subset also hitting other vendors' VPN logins. It also tracked a German-hosted source harvesting application secrets by probing Laravel CVE-2024-29291 and TeleMessage CVE-2025-48927 alongside scanning for exposed .env, Git, AWS, and Spring Boot Actuator files, and broadening Netherlands-hosted scanning of the Hikvision /SDK/webLanguage endpoint (CVE-2021-36260).
Why it matters: A jump from double digits to 3,645 brute-forcing sources in one week means credential attacks on VPN edges are scaling fast, and the same actors are not limiting themselves to Cisco. The German-hosted source is deliberately harvesting secrets from exposed .env, Git, and AWS files rather than crawling opportunistically, so anything left readable on an edge host is already in scope.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-36260CVE-2024-29291CVE-2025-48927
- Related
- CVE-2025-48927: Tele Message TM SGNL Initialization of a Resource with an Insecure Default Vulnerability Known Exploited Vulnerabilities · Jul 01, 2025CVE-2021-36260: Hikvision Improper Input Validation Known Exploited Vulnerabilities · Jan 10, 2022