Company
Cyber threat intelligence company that runs honeypots to detect and report in-the-wild exploitation attempts against newly disclosed vulnerabilities.
Defused researchers say first exploitation attempts reached their decoys on 8 October, two days after SonicWall disclosed its CVSS 10.0 SMA1000 flaw. The advisory, last updated 6 October, still says there is no evidence of exploitation.
Reality
SAP fixed CVE-2026-89111, a maximum-severity OAuth2 SSRF in its Cloud SDK for Python, in a 20-flaw October 2026 update. A multi-tenant BTP app that lets outside input set tenant_subdomain can send its client credentials to an attacker until it is patched or allowlisted.
Perspective Coverage
4 publishersReality
CVE-2026-58231 is an unauthenticated, CVSS 10.0 code execution bug in Commerce Cloud's Data Hub Adapter. Defused says attempts hit its honeypots three days after patch day.
Perspective Coverage
4 publishersReality
A third party published CVE-2026-63520 before the planned date, and two public gadget chains now reach the same flaw by different routes. One signature will not cover both.
Reality
CVE-2026-8452 shipped as a June 30 denial-of-service fix. A WatchTowr proof of concept turned it into pre-auth code execution, and in-the-wild exploitation followed.
Perspective Coverage
7 publishersReality
PaperCut shipped emergency fixes for CVE-2026-81578 and CVE-2026-82078 on Thursday and Friday, and by the weekend Defused was watching honeypot intruders bypass authentication and read database tables instead of running code.
Reality
ServiceNow fixed its own hosted fleet on August 27 and handed the same update to partners and self-hosted customers, whose unauthenticated GraphQL and SQL exposure stays open until someone on staff installs it.
Reality
Attackers are forging tokens SharePoint accepts, then enumerating management APIs and probing Business Connectivity Services for the execution sink. BleepingComputer reports nobody has seen that last step land.
Reality
CVE-2026-58231 chains a default auth client with missing input validation in SAP's Data Hub Adapter. The fix needs a rebuild and redeploy; the attackers needed 72 hours.
Reality
CVE-2026-55040 was patched in July. Rapid7 published the technical details and a script on August 11, and Defused says its honeypots logged exploitation on August 12.
Reality