Edge Device Exploit Trends: Honeypot Analysis

Data: Defused Cyber honeypot telemetry, high and critical severity alerts only  ·  Period: Mar 14 - Jul 16, 2026 (two export windows, 6-day gap Apr 14-18; gap Jun 10 (export row-capped; complete count unavailable))  ·  88,299 exploit attempts  ·  Generated: 2026-07-16

Detection Chokepoint Framework

Every exploit in this dataset (Cisco SD-WAN, Citrix, SonicWall, Fortinet) follows the same chain. The CVE changes. The tooling changes. The five stages don't. Each badge maps to the ATT&CK technique you're detecting at that stage.

Authentication bypass, credential harvest, and webshell deployment: those three stages are where your detection budget compounds. Recon scanning generates volume but the attacker can change tools and IPs freely. Post-exploit behavior matters but varies by environment. The middle three are the invariants.

Monthly Volume: Daily Exploit Attempts

Daily hit volume across 45 decoy types. The spikes aren't gradual trends. They're specific campaigns lighting up.

Recon vs. Exploitation: The Early-Warning Window

Every alert in this window is one of two things: weaponized exploitation ("Vulnerability Exploited") or targeted recon — probing, vuln-checks, and exposure scans against a specific CVE. In the Apr 19 - Jul 16, 2026 window the split is 84% exploitation / 16% recon. Recon usually arrives first, so the gap between the two is a lead indicator: when probing for a CVE ramps, weaponization tends to follow.

Where Recon Preceded Exploitation

CVEs where probing was observed before the first weaponized hit. Lead times are lower bounds within the export window — a CVE already active at the window start shows no lead.

Target Distribution: What Adversaries Are Hunting

Combined across all observation windows. Citrix now takes 72% of all traffic, up from 47% a window ago, almost entirely CitrixBleed 2. Underneath it the composition keeps shifting: React Server (CVE-2025-55182) and cPanel/WHM (CVE-2026-41940) were brand-new in the second window and have kept climbing, FortiWeb held its place, and SD-WAN and SAP burned hot then cooled, classic burst-campaign behavior.

CVE-2026-20127: Full Kill Chain in Honeypot Data

CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN. Disclosed Feb 25, 2026. CISA KEV with 24-hour remediation. We captured the full attack chain: 137 IPs progressing from recon through auth bypass, webshell upload, and cryptominer deployment.

Attack Chain Stages: Observed in Honeypot

Auth Bypass: Hardcoded DCA Credentials

The "First Part" stage sends authentication requests using the viptela-reserved-dca service account, a default internal account used by the Data Collection Agent.

Webshell Upload: Path Traversal to Wildfly

Post-authentication, attackers exploit the /dataservice/smartLicensing/uploadAck endpoint to upload .war files via path traversal into the Wildfly deployment directory.

Webshell Commands: Post-Exploit Activity

Once the SD-WAN vManage RCE (CVE-2026-20127) drops the cmd.gz.war webshell, attackers run commands through POST /cmd.gz/cmd.jsp (a cmd= parameter). In the live window (Apr 19 – Jul 16) the webshell drew only 33 command executions, all trivial enumeration from a handful of IPs. The heavy post-exploit chain, mass cryptominer deployment and reverse shells, was a Mar–Apr baseline burst that did not recur (see callout).

Credential Harvesting: DCA Config Files

739 requests targeted the .dca (Data Collection Agent) configuration file. This file contains credentials used by the DCA service to authenticate to vManage. Harvesting this file gives attackers legitimate credentials for lateral movement within the SD-WAN fabric.

CVE-2025-5777: CitrixBleed 2 (T1190 Pre-Auth Memory Disclosure)

Same vulnerability class as the original CitrixBleed that hit Boeing and ICBC. Pre-auth memory disclosure, ~127 bytes per request, session tokens leak out. The exploit is trivial: a 5-byte POST body with the word login. Across the full dataset it's 62,205 hits, 70% of all traffic, and a single late-May surge accounts for most of the recent growth.

Exploitation Pattern

Every hit targets a single endpoint: POST /p/u/doAuthentication.do with a malformed login parameter (no equals sign or value). 99.8% of the live-window traffic uses one identical truncated User-Agent string, the fingerprint of a shared exploit toolkit. Four months on, the toolkit hasn't changed; only the hosts running it have.

CitrixBleed 2 Daily Exploitation Trend

CVE-2022-22536 + CVE-2025-31324: SAP Surge (Apr 9–11)

SAP Netweaver sits sixth on the targets bar with 1,638 total hits across the full window, but that total is a single historical burst, not sustained pressure. A concentrated 72-hour run Apr 9–11 on CVE-2022-22536, a 2022 CVSS 10.0 memory corruption / request smuggling vulnerability in SAP ICM, drove 1,024 of those hits. The remaining 614 targeted CVE-2025-31324, the critical SAP NetWeaver Visual Composer RCE disclosed in 2025, spread across the live window.

CVE-2022-22536: 4-Year-Old CVSS 10.0 Still Under Active Exploitation

The Apr 9–11 burst hit 176 unique IPs in three days: concentrated scanning across a wide source range rather than a single operator. CVE-2022-22536 allows unauthenticated HTTP request smuggling against SAP ICM, enabling memory disclosure and session token theft without credentials. Patched in 2022. Still drew 1,024 hits, almost all inside a 72-hour window, in 2026.

CVE-2025-40599: SonicWall SMA Path Traversal + Self-Replicating Worm

1,693 hits against SonicWall SMA decoys via double-encoded path traversal to reach /bin/sh. Every request carries the libredtail-http User-Agent, a custom HTTP client seen in no other campaign, which makes the traffic trivial to isolate. The payload host rotates: the worm has pulled its apache.selfrep script from at least five /sh staging endpoints across the window (see Staging Infrastructure), most recently 217[.]60[.]195[.]113.

CVE-2025-25257: FortiWeb Multi-Stage SQLi via Bearer Token

237 requests targeting FortiWeb's /api/fabric/device/status endpoint. Attackers embed SQL injection payloads inside the Authorization: Bearer header, an unusual injection point that bypasses WAF rules typically inspecting query parameters and POST bodies.

CVE-2026-21643: FortiClient EMS SQLi, New Operator Fingerprint (Apr 2)

FortiClient EMS SQLi jumped from 159 to 187 hits (+28 on Apr 2). A new operator fingerprint emerged: payloads containing alireza_cve_2026_21643_test appeared alongside the existing nuclei_cve_2026_21643_test pattern.

Attack Progression

CVE-2026-1281 / CVE-2026-1340: Ivanti EPMM Reverse Shell (Apr 3)

5 requests on Apr 3 targeting Ivanti EPMM via the /mifs/c/appstore/fob/ endpoint. The payload embeds a bash reverse shell directly in the URL path using backtick command injection inside the sha256 hash parameter.

CVE-2019-19781: 6-Year-Old Citrix Vuln Still Getting Probed (Apr 3)

2 hits probing for CVE-2019-19781, a path traversal in Citrix ADC first disclosed December 2019. This CVE is 6+ years old and still being actively probed, reinforcing that edge device vulnerabilities have extremely long exploitation tails.

CVE-2025-64446: FortiWeb API Path Traversal (Apr 2 Spike)

FortiWeb path traversal exploitation jumped to 63 hits, with 22 new attempts on Apr 2 from two IPs in the same 101[.]71[.]38[.]0/24 netblock. The exploit abuses URL-encoded %3f (question mark) in the API path to traverse to /cgi-bin/fwbcgi.

CVE-2026-41940: cPanel WHM Authentication Bypass (3-Stage Chain)

Up to 2,049 hits on cPanel/WHM decoys across the dataset, exploiting a 3-stage chain. Stage 1 mints a session token via an intentionally wrong password - the bug causes the server to issue a valid session cookie despite authentication failure. Stage 2 uses that minted session to call /json-api/listaccts, harvesting all hosted account credentials. Stage 3 uses the cache propagation gadget at /scripts2/listaccts to persist access across session expiry. In the window where it first appeared, 164 unique IPs hit Stage 1 and only 13 progressed to Stage 2, so most operators are scanning rather than doing full account takeover. That funnel shape has held: the preauth session-mint stage still carries the bulk of the volume.

CVE-2025-55182: Next.js Server Actions RCE

7,146 hits on React Server decoys across the dataset, from 657 unique source IPs, the most distributed campaign on the page. The exploit sends a POST / with a Next-Action header and a multipart body to trigger unauthenticated remote code execution in Next.js Server Actions. When it first appeared it was almost entirely Go-http-client/1.1 (97% of requests), a near-reliable User-Agent detection layer; the traffic has since diversified as the PoC spread. The wide source spread (hundreds of IPs, low hits each) still reads as broad opportunistic scanning rather than a single operator, the opposite of the CitrixBleed 2 concentration above.

CVE-2022-1388: F5 iControl REST Auth Bypass Resurfaces

314 hits across 10 unique IPs targeting F5 Big-IP decoys via the 2022 iControl REST authentication bypass. All requests use a static forged X-F5-Auth-Token header (ea5641ae55012ddb91da9978663575) and hit /mgmt/tm/util/bash to probe for command execution access. This CVE is 3 years old; the static token is a shared PoC artifact, which means these 10 operators are running the same public exploit tool without modification.

Attacker Tooling: Scanner & Automation Fingerprints

Only about 5% of live-window traffic (Apr 19 – Jul 16) self-identifies with a named-tool User-Agent. The rest hides in plain sight: roughly 85% spoofs a browser UA and 9% sends no User-Agent at all. That's a sharp drop from the 38.7% self-identification measured in the spring baseline window, and the CitrixBleed 2 flood is why: its toolkit presents a browser UA, so as it grew to dominate the dataset, UA-based tool attribution collapsed.

No single tool dominates the self-identifying slice anymore. Go-http-client, the SonicWall worm's libredtail-http, python-requests, and sqlmap sit within a few points of each other. libredtail-http stays exclusive to the SonicWall worm above, and l9scan is LeakIX's internet-wide scanner. These are live-window counts; the frozen Mar–Apr baseline is not recomputable at User-Agent granularity.

Multi-Device Operators: IPs Scanning Across Decoy Types

Live-window (Apr 19 – Jul 16) source IPs that hit the most distinct decoy families. Observed is the telemetry first-to-last-seen window, not a liveness probe. Known research scanners (e.g. ONYPHE, LeakIX) are excluded.

Staging Infrastructure

Payload staging URLs pulled from the shell-fetch and webshell payloads in the live window (Apr 19 – Jul 16). The Mar–Apr baseline hosts (kernel.sh, 31[.]57[.]216[.]121, nullnet, miso88) have all gone quiet; these superseded them. Observed is the telemetry window, not a liveness probe.

Hosting Provenance: Where the Traffic Originates

Every attacker IP resolved to its hosting ASN (Team Cymru, cross-checked against IPinfo). This is where the exploit traffic is hosted — and watching the mix shift month over month is how abuse-tolerant / bulletproof rotation surfaces. 2998 cumulative unique source IPs across Apr 2026 - Jul 2026.

Detection Recommendations

Each detection maps to the technique it catches. The ones that survived every CVE rotation in this dataset are at the top.