Edge Device Exploit Trends: Honeypot Analysis

Data: Defused Cyber honeypot telemetry, high and critical severity alerts only  ·  Period: Mar 14 - May 19, 2026 (two export windows, 6-day gap Apr 14-18)  ·  25,420 exploit attempts  ·  Generated: 2026-06-14

Detection Chokepoint Framework

Every exploit in this dataset (Cisco SD-WAN, Citrix, SonicWall, Fortinet) follows the same chain. The CVE changes. The tooling changes. The five stages don't. Each badge maps to the ATT&CK technique you're detecting at that stage.

Authentication bypass, credential harvest, and webshell deployment: those three stages are where your detection budget compounds. Recon scanning generates volume but the attacker can change tools and IPs freely. Post-exploit behavior matters but varies by environment. The middle three are the invariants.

Monthly Volume: Daily Exploit Attempts

Daily hit volume across 22 decoy types. The spikes aren't gradual trends. They're specific campaigns lighting up.

Recon vs. Exploitation: The Early-Warning Window

Every alert in this window is one of two things: weaponized exploitation ("Vulnerability Exploited") or targeted recon — probing, vuln-checks, and exposure scans against a specific CVE. In the Apr 19 - May 19, 2026 window the split is 67% exploitation / 33% recon. Recon usually arrives first, so the gap between the two is a lead indicator: when probing for a CVE ramps, weaponization tends to follow.

Where Recon Preceded Exploitation

CVEs where probing was observed before the first weaponized hit. Lead times are lower bounds within the export window — a CVE already active at the window start shows no lead.

Target Distribution: What Adversaries Are Hunting

Combined across both observation windows. Citrix still dominates at 47% of all traffic, but the composition has shifted: React Server (CVE-2025-55182) and cPanel/WHM (CVE-2026-41940) are brand-new targets that didn't appear in the first window at all. FortiWeb doubled. SD-WAN and SAP burned hot then cooled - classic burst-campaign behavior.

CVE-2026-20127: Full Kill Chain in Honeypot Data

CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN. Disclosed Feb 25, 2026. CISA KEV with 24-hour remediation. We captured the full attack chain: 137 IPs progressing from recon through auth bypass, webshell upload, and cryptominer deployment.

Attack Chain Stages: Observed in Honeypot

Auth Bypass: Hardcoded DCA Credentials

The "First Part" stage sends authentication requests using the viptela-reserved-dca service account, a default internal account used by the Data Collection Agent.

Webshell Upload: Path Traversal to Wildfly

Post-authentication, attackers exploit the /dataservice/smartLicensing/uploadAck endpoint to upload .war files via path traversal into the Wildfly deployment directory.

Webshell Commands: Post-Exploit Activity

Once the webshell is deployed at /cmd.gz/cmd.jsp, attackers execute commands through POST requests. The command breakdown reveals a clear operational progression: enumeration → miner deployment → persistence.

Credential Harvesting: DCA Config Files

739 requests targeted the .dca (Data Collection Agent) configuration file. This file contains credentials used by the DCA service to authenticate to vManage. Harvesting this file gives attackers legitimate credentials for lateral movement within the SD-WAN fabric.

CVE-2025-5777: CitrixBleed 2 (T1190 Pre-Auth Memory Disclosure)

Same vulnerability class as the original CitrixBleed that hit Boeing and ICBC. Pre-auth memory disclosure, ~127 bytes per request, session tokens leak out. The exploit is trivial: a 5-byte POST body with the word login. This window: 8,112 hits, 54% of all traffic, still growing.

Exploitation Pattern

All 8,112 hits target a single endpoint: POST /p/u/doAuthentication.do with a malformed login parameter (no equals sign or value). 97% of traffic uses an identical truncated User-Agent string, indicating a shared exploit toolkit spreading to new operators.

CitrixBleed 2 Daily Exploitation Trend

CVE-2022-22536 + CVE-2025-31324: SAP Surge (Apr 9–11)

SAP jumped from a footnote to the third most targeted platform in this window. 1,179 total hits on SAP Netweaver decoys, driven by a concentrated 72-hour burst Apr 9–11 on CVE-2022-22536, a 2022 CVSS 10.0 memory corruption / request smuggling vulnerability in SAP ICM. An additional 155 hits targeted CVE-2025-31324, the critical SAP NetWeaver Visual Composer RCE disclosed in 2025.

CVE-2022-22536: 4-Year-Old CVSS 10.0 Still Under Active Exploitation

The Apr 9–11 burst hit 176 unique IPs in three days: concentrated scanning across a wide source range rather than a single operator. CVE-2022-22536 allows unauthenticated HTTP request smuggling against SAP ICM, enabling memory disclosure and session token theft without credentials. Patched in 2022. Still getting 1,024 hits in a 31-day window in 2026.

CVE-2025-40599: SonicWall SMA Path Traversal + Self-Replicating Worm

478 attempts across 284 unique IPs targeting SonicWall SMA decoys via double-encoded path traversal to reach /bin/sh. Every request uses the libredtail-http User-Agent, a custom HTTP client not seen in any other campaign. 284 unique IPs is the most distributed attacker base of any campaign in this dataset.

CVE-2025-25257: FortiWeb Multi-Stage SQLi via Bearer Token

237 requests targeting FortiWeb's /api/fabric/device/status endpoint. Attackers embed SQL injection payloads inside the Authorization: Bearer header, an unusual injection point that bypasses WAF rules typically inspecting query parameters and POST bodies.

CVE-2026-21643: FortiClient EMS SQLi, New Operator Fingerprint (Apr 2)

FortiClient EMS SQLi jumped from 159 to 187 hits (+28 on Apr 2). A new operator fingerprint emerged: payloads containing alireza_cve_2026_21643_test appeared alongside the existing nuclei_cve_2026_21643_test pattern.

Attack Progression

CVE-2026-1281 / CVE-2026-1340: Ivanti EPMM Reverse Shell (Apr 3)

5 requests on Apr 3 targeting Ivanti EPMM via the /mifs/c/appstore/fob/ endpoint. The payload embeds a bash reverse shell directly in the URL path using backtick command injection inside the sha256 hash parameter.

CVE-2019-19781: 6-Year-Old Citrix Vuln Still Getting Probed (Apr 3)

2 hits probing for CVE-2019-19781, a path traversal in Citrix ADC first disclosed December 2019. This CVE is 6+ years old and still being actively probed, reinforcing that edge device vulnerabilities have extremely long exploitation tails.

CVE-2025-64446: FortiWeb API Path Traversal (Apr 2 Spike)

FortiWeb path traversal exploitation jumped to 63 hits, with 22 new attempts on Apr 2 from two IPs in the same 101[.]71[.]38[.]0/24 netblock. The exploit abuses URL-encoded %3f (question mark) in the API path to traverse to /cgi-bin/fwbcgi.

CVE-2026-41940: cPanel WHM Authentication Bypass (3-Stage Chain)

1,515 hits on cPanel/WHM decoys across a 3-stage exploitation chain. Stage 1 mints a session token via an intentionally wrong password - the bug causes the server to issue a valid session cookie despite authentication failure. Stage 2 uses that minted session to call /json-api/listaccts, harvesting all hosted account credentials. Stage 3 uses the cache propagation gadget at /scripts2/listaccts to persist access across session expiry. 164 unique IPs hit Stage 1; only 13 progressed to Stage 2, confirming most operators are scanning rather than doing full account takeover.

CVE-2025-55182: Next.js Server Actions RCE

2,653 hits on React Server decoys from 292 unique IPs - the most distributed new campaign in this window. The exploit sends a POST / with a Next-Action header and a multipart body to trigger unauthenticated remote code execution in Next.js Server Actions. 97% of requests use Go-http-client/1.1, making User-Agent matching a near-reliable detection layer while it lasts. The extreme distribution (292 IPs for 2,653 hits) suggests a public PoC driving broad opportunistic scanning rather than a single operator campaign.

CVE-2022-1388: F5 iControl REST Auth Bypass Resurfaces

314 hits across 10 unique IPs targeting F5 Big-IP decoys via the 2022 iControl REST authentication bypass. All requests use a static forged X-F5-Auth-Token header (ea5641ae55012ddb91da9978663575) and hit /mgmt/tm/util/bash to probe for command execution access. This CVE is 3 years old; the static token is a shared PoC artifact, which means these 10 operators are running the same public exploit tool without modification.

Attacker Tooling: Scanner & Automation Fingerprints

38.7% of traffic self-identifies via User-Agent. That's the floor. The other 61% spoof browser UAs but behave like bots.

python-requests dominates at 78% of scanner-attributed traffic. libredtail-http is exclusively associated with the SonicWall worm campaign.

Multi-Device Operators: IPs Scanning Across Decoy Types

Staging Infrastructure

Payload staging URLs extracted from webshell commands and shell eval payloads.

Hosting Provenance: Where the Traffic Originates

Every attacker IP resolved to its hosting ASN (Team Cymru, cross-checked against IPinfo). This is where the exploit traffic is hosted — and watching the mix shift month over month is how abuse-tolerant / bulletproof rotation surfaces. 1029 cumulative unique source IPs across Apr 2026 - May 2026.

Detection Recommendations

Each detection maps to the technique it catches. The ones that survived every CVE rotation in this dataset are at the top.