Coordinated Grafana Exploitation Attempts on 28 September
Summary: On 28 September 2025, GreyNoise recorded a one-day surge of exploitation attempts against CVE-2021-43798, a Grafana path traversal flaw that allows arbitrary file reads, with 110 unique IPs hitting its Global Observation Grid. All 110 IPs were classified as malicious, and two geolocated to China on CHINANET-BACKBONE were first seen that day, active only that day, and focused overwhelmingly on Grafana.
Bottom line: GreyNoise says the alignment across geography and tooling points to shared tasking or a common target list rather than uncoordinated traffic, and it expects old vulnerabilities like CVE-2021-43798, and even older ones, to keep resurging.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-43798
- Related
- CVE-2021-43798: Grafana Path Traversal Vulnerability Known Exploited Vulnerabilities · Oct 09, 2025Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026