Volexity says UTA0576 used a zero-day chain to get unauthenticated root on a fully patched Ivanti Connect Secure 22.8R2.4 VPN. Ivanti's Integrity Checker Tool does not flag it, so the check for lateral movement from the VPN device falls to forensics.
Perspective Coverage
10 publishers
- Builder
- Builder 15%
- Operator
- Operator 70%
- Investor
- Investor 15%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+8
- Incentives40
- Confidence78
Attackers began targeting SonicWall's maximum-severity SMA1000 flaw CVE-2026-102255 within three days of its patch, Previdian's honeypots show. SonicWall's advisory had not called it exploited by Friday, so owners waiting on that label are patching behind the attackers.
Perspective Coverage
7 publishers
- Builder
- Builder 17%
- Operator
- Operator 77%
- Investor
- Investor 6%
Reality
- Evidence66
- Adoption25
- Hype gap+28
- Incentives40
- Confidence72
Public exploit for CVE-2026-88771 turns a quiet NetScaler zero-day into internet-wide attacks
A public proof-of-concept for CVE-2026-88771 pushed a stealthy NetScaler zero-day into mass exploitation, with fewer than 10% of exposed hosts patched. Citrix admits its detection script may miss intrusions, so exposed appliances should be treated as breached.
Reality
- Evidence60
- Adoption70
- Hype gap+8
- Incentives35
- Confidence62
buildOne report1 publisher Patching NetScaler to 14.1-73.37 leaves planted webshells and persistence in place
Attackers using two NetScaler zero-days since early September left webshells that patching to 14.1-73.37 or 13.1-64.23 does not remove. Operators have to search every appliance for those traces, patched or not, and move OT remote access onto a jump host of its own.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence60
Pre-auth NetScaler exploit plants a superuser account and hidden web shells
LevelBlue says attackers are exploiting NetScaler flaw CVE-2026-88771, rated 9.5, to create a hidden superuser account and plant web shells. The patch closes the injection but removes neither, so already-exposed appliances need a compromise check.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence60
CVE-2026-8452 shipped as a June 30 denial-of-service fix. A WatchTowr proof of concept turned it into pre-auth code execution, and in-the-wild exploitation followed.
Perspective Coverage
7 publishers
- Builder
- Builder 14%
- Operator
- Operator 80%
- Investor
- Investor 6%
Reality
- Evidence78
- Adoption50
- Hype gap−40
- Incentives
- Not scored
- Confidence74
buildOne report1 publisher Chaining a 10.0 portal SSRF to a 7.8 console injection gets OS execution on SonicWall's SMA1000
SonicWall confirmed both SMA1000 flaws were exploited before disclosure, and CISA gave federal agencies three days to remediate. The lower-scored console bug is the step that reaches the operating system.
Reality
- Evidence55
- Adoption60
- Hype gap+8
- Incentives35
- Confidence48
buildOne report1 publisher One Mirai variant now proxies, sniffs and spreads: the appliance layer is a pivot, not DDoS fodder
FortiGuard Labs says Evooo1Bot packs SOCKS5 relaying, credential sniffing, SSH spreading and 16 flood modes into one binary across 12 CPU architectures. The tunnel matters more than the flood.
Reality
- Evidence48
- Adoption
- Not scored
- Hype gap+18
- Incentives58
- Confidence42