This Week in CVEs: Exploitation Expands Across Backup, Remote Access, and Developer Infrastructure

By SAFE Threat Research Team

This week’s exploitation activity expanded across some of the most operationally important layers of enterprise infrastructure – from backup platforms and remote-access appliances to collaboration and developer systems.

AhsayCBS saw the clearest post-exploitation activity, with chained flaws leading to remote code execution, web shells, and mining activity. SonicWall SMA1000 was targeted through SSRF, while Atlassian, GitLab, Bricksforge, Rejetto HFS, and NetScaler each exposed different attack paths across collaboration, development, application, and access infrastructure.

The broader pattern is that attacker activity is increasingly touching systems that organizations rely on to store, manage, connect, or administer other parts of the environment. That raises the impact of exploitation beyond the vulnerable product itself and makes exposure context critical to prioritization.

Vulnerability Landscape

The overall disclosure volume remains high, with 3,522 CVEs published, 1,415 rated critical or high severity, 516 with public exploit or proof-of-concept code, and 18 showing weaponized exploit signals.

The more useful signal is not how many exploits exist, but how quickly a small subset starts showing real attacker activity. This week, that gap was visible across several enterprise products, where public technical details were followed almost immediately by probing or exploitation.

Trending Vulnerabilities

16 CVEs showed exploitation signals, including 2 newly published vulnerabilities and 14 pre-existing issues. 

The mix is important. Freshly disclosed flaws are being tested quickly, but older vulnerabilities are still generating activity, with the affected product remaining exposed or the exploit path still offering useful access. This week’s seven deep dives reflect both ends of that spectrum: newly operationalized flaws alongside older CVEs that remain active because their exploitation value has not diminished.

Top CVEs to Watch

AhsayCBS vulnerabilities chained for unauthenticated remote code execution

CVE-2026-105133, CVE-2026-105134

Two critical vulnerabilities in AhsayCBS are being actively exploited against internet-exposed backup infrastructure. CVE-2026-105133 allows an unauthenticated attacker to bypass authentication in the CBS API, while CVE-2026-105134 enables operating-system command injection through the Replication Receiver component. When chained, the flaws provide a direct path from unauthenticated network access to remote code execution on the affected server.

Observed attacks have progressed beyond reconnaissance or proof-of-concept testing. Attackers have deployed JSP web shells, executed host discovery commands, and installed XMRig cryptocurrency miners, while attempting to disguise malicious processes and services as legitimate Microsoft Edge components. PowerShell has also been used during post-exploitation activity.

The remediation path changed after the initial disclosure. Ahsay subsequently confirmed that version 10.3.4.0 did not completely address the vulnerabilities and released the 10.3.4.45 hotfix for affected v10 installations. Organizations that operated internet-accessible AhsayCBS systems before applying the complete fix should investigate for evidence of compromise in addition to upgrading.

Backup infrastructure warrants a particularly high priority because it often stores sensitive data and provides privileged connectivity to production systems. A successful compromise can therefore expose considerably more than just the backup server itself.

SonicWall SMA1000 flaw targeted shortly after disclosure

CVE-2026-102255

CVE-2026-102255 is a critical pre-authentication server-side request forgery vulnerability affecting the WorkPlace interface of SonicWall SMA1000 appliances. The flaw can allow an unauthenticated remote attacker to cause the appliance to communicate with services that are otherwise inaccessible from the internet.

Exploitation attempts targeting CVE-2026-102255 were observed shortly after disclosure. The activity used the vulnerable WorkPlace interface to attempt SSRF requests to an internal CouchDB service bound to 127.0.0.1:5984. While the traffic is consistent with exploitation of the vulnerability, successful compromise has not been publicly confirmed.

Organizations running affected SMA1000 appliances should upgrade immediately, restrict unnecessary exposure of management and WorkPlace interfaces, and review appliance logs for suspicious requests reaching internal services through the vulnerable SSRF path.

Atlassian file-access flaw moves into exploitation within hours

CVE-2026-21589

CVE-2026-21589 affects multiple self-managed Atlassian products, including Jira Software, Jira Service Management, Confluence Data Center, Bitbucket Data Center, Bamboo, Crowd, Crucible, and Fisheye. The vulnerability allows an unauthenticated remote attacker who knows the target path to retrieve files located within the application’s web root.

The risk extends beyond generic file disclosure. In certain deployments, sensitive configuration files can expose credentials used between Atlassian applications and centralized identity services. Access to these credentials can provide attackers with a path from an initial file-read primitive to higher-privileged application access, depending on the permissions associated with the exposed account.

Exploitation activity was detected within hours of detailed technical information becoming publicly available, indicating rapid weaponization and automated probing of exposed instances. Self-managed Atlassian environments should be prioritized where affected applications are externally reachable, especially when multiple Atlassian products share authentication infrastructure or service credentials.

Bricksforge file-upload vulnerability exploited for remote code execution

CVE-2026-85097

CVE-2026-85097 is an unauthenticated arbitrary file-upload vulnerability affecting the Bricksforge plugin for WordPress. The flaw allows a remote attacker to upload executable PHP content to a vulnerable server, providing a straightforward path to remote code execution.

Active exploitation began shortly after public disclosure. Attackers have been observed systematically varying PHP extensions, filename capitalization, and encoded values while attempting to bypass upload restrictions and place executable files in Bricksforge temporary-upload and standard WordPress upload locations. The activity includes highly similar requests originating from distributed infrastructure, indicating automated exploitation rather than isolated testing.

The vulnerability is fixed in Bricksforge 3.1.8.10. Administrators should update immediately and review affected systems for unexpected PHP files, particularly within temporary and upload directories used by the plugin.

NetScaler vulnerability exploited against SAML-enabled gateways

CVE-2026-88779

CVE-2026-88779 is a memory-overflow vulnerability affecting customer-managed NetScaler ADC and NetScaler Gateway deployments configured as a SAML Service Provider or SAML Identity Provider. Exploitation does not require authentication or user interaction, and targeted attacks have been observed against unpatched systems.

The confirmed impact is denial-of-service. Repeated exploitation can crash or disrupt affected gateways, potentially making authentication, VPN access, or externally published applications unavailable. The vulnerability remains operationally significant because NetScaler frequently sits directly in the authentication and application-delivery path. Successful exploitation can therefore disrupt access to multiple downstream services, even without granting the attacker code execution.

Organizations using affected SAML configurations should apply the available updates and review gateway telemetry for repeated malformed requests, unexplained service restarts, or availability disruptions consistent with exploitation.

Rejetto HFS authentication bypass targeted for remote code execution

CVE-2026-61500

CVE-2026-61500 is a critical authentication bypass vulnerability affecting Rejetto HTTP File Server 3.x. The flaw stems from weak randomness used for session signing, allowing an unauthenticated attacker to predict or brute-force the signing value and forge a valid administrator session. Administrative access can then be used to reach functionality that enables remote code execution on the underlying host. 

Exploitation attempts were observed beginning on October 1 against internet-facing HFS instances, shortly after technical details became public. The activity targeted vulnerable hosts across multiple countries and demonstrated rapid adoption of the session-forgery technique by attackers. Affected deployments should be upgraded to HFS 3.2.1 or later. Organizations should also review exposed instances for suspicious administrative sessions, configuration changes, or unexpected command execution, particularly where the service was previously internet-accessible.

GitLab path traversal remains under active exploitation

CVE-2026-85706

CVE-2026-85706 is a critical unauthenticated path traversal vulnerability affecting self-managed GitLab Community Edition and Enterprise Edition. The issue resides in the repository commits API and allows an attacker to supply an arbitrary server-side path, causing GitLab to access local files instead of the expected upload content. Potential targets include GitLab configuration files, application secrets, SSH keys, and other files that the GitLab process can read.

The vulnerability has been exploited in the wild, with activity targeting sensitive local files on exposed self-managed instances. Exploitation can result in disclosure of credentials and secrets that may support further access to repositories, integrations, or connected infrastructure. Importantly, a successful file read does not always mean the file contents were returned to the attacker, so HTTP status alone is insufficient to determine whether exfiltration occurred.

Organizations should upgrade affected self-managed GitLab instances and investigate suspicious repository-commit API requests that reference local filesystem paths. Where exploitation is suspected, review access to sensitive GitLab configuration and secret material and rotate exposed credentials where necessary.

What Security Teams Should Prioritize

Prioritization this week should start with evidence of exploitation and exposure –

• Patch actively targeted internet-facing systems first, especially AhsayCBS, SonicWall SMA1000, Atlassian Data Center products, Bricksforge, NetScaler, Rejetto HFS, and self-managed GitLab.
• Investigate systems that were exposed before remediation. For several of these CVEs, attacker activity was observed shortly after disclosure, so patching does not rule out prior compromise.
• Validate the actual attack path for each product. Look for the behaviors tied to the vulnerability rather than relying only on generic IOC matching – for example, suspicious file access, unexpected uploads, SSRF requests, forged sessions, gateway crashes, or abnormal administrative activity.
• Prioritize systems with direct internet exposure or broad operational importance, even where the underlying vulnerability is not remote code execution.
• Keep older exploited CVEs in scope when current activity continues. This week’s GitLab example is a reminder that attacker interest can remain high well after the initial disclosure window.

From Vulnerability to Exposure

The vulnerabilities covered this week show why remediation priority cannot be determined by severity or disclosure timing alone. The more consequential cases are those where a flaw intersects with a system that is reachable, operationally important, and capable of giving an attacker useful leverage once exploited.

That changes what “critical” should mean in practice. An SSRF against a remote-access appliance, file access on a developer platform, or disruption of an authentication gateway can be as significant as direct code execution when the affected product sits in the path of broader enterprise access.

The priority is therefore not to patch every severe CVE at the same speed, but to identify where active exploitation, real exposure, and system importance overlap. SAFE CTEM helps teams make that distinction by connecting current threat activity with asset context and exposure, so remediation is driven by the vulnerabilities most likely to translate into meaningful business risk.