At The Edge Clear: June 08 - 15, 2026
Summary: In its June 08–15, 2026 analysis period, GreyNoise reported that a single host probed VPN gateways, application delivery controllers, file-transfer appliances, and webmail in a one-week sweep, with low per-product volume but broad coverage it read as a target list being built. Two hosts on separate Netherlands networks ran the same Hikvision camera exploit (CVE-2021-36260, CISA KEV) with shared tooling, while credential attacks on Palo Alto, Cisco, and SonicWall remote-access portals held steady.
What you should know: The Hikvision flaw is on CISA's Known Exploited Vulnerabilities list and the cameras remain widely deployed across commercial and critical infrastructure networks despite U.S. and allied government restrictions, so an internet-facing camera can be the entry point into the same estate your VPN portal sits in.
Read the original at GreyNoise Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2021-36260
- Related
- CVE-2021-36260: Hikvision Improper Input Validation Known Exploited Vulnerabilities · Jan 10, 2022At The Edge Clear: June 15 - 23, 2026 Cyber Risks ·