Cloud Takeover: Mass Scanning for Exposed Vite Endpoints (CVE-2026-39364)

Introduction

August 2026 saw an escalation in automated reconnaissance targeting internet-exposed developer tooling. Honeynet sensors recorded a sustained scanning operation focused on pulling cloud credentials and infrastructure state files out of exposed Vite development servers. The campaign generated 807 session-grouped attacks, roughly 32,000 raw events over the monthly analysis window.

The activity was anchored by probes matching CVE-2026-39364, a high-severity file-read vulnerability that entered the monthly top-CVE tracking list, alongside recurring signatures for older Vite bypass flaws. Rather than target a single file, the scanning fleet systematically cycled through extensive wordlists of environment files, AWS keys, Azure tokens, and Infrastructure-as-Code state files. The rapid increase from baseline background noise highlights how quickly newly disclosed bypass methods are folded into automated credential-harvesting operations.

Vite Development Server File Disclosure (CVE-2026-39364)

CVE-2026-39364 is an unauthenticated file-read and access-list bypass vulnerability affecting the Vite development server.

• CVSS Score: 7.5 (High)
• CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
• Affected Versions: Vite 7.1.0 to versions prior to 7.3.2 and 8.0.5
• Authentication Required: None
• Published: April 7, 2026

Successful exploitation allows remote, unauthenticated attackers to bypass server.fs.deny configurations and retrieve restricted system and configuration files over HTTP.

Vulnerability Context

Vite functions as a local development server and build tool. To support development workflows, it exposes an internal @fs route designed to serve files from the host filesystem. It relies on a deny-list setting (server.fs.deny) to block access to sensitive items such as .env files, certificates, and private application source code.

CVE-2026-39364 allows an attacker to bypass these restrictions entirely through query parameter manipulation. When specific parameters such as ?raw, ?import&raw, or ?import&url&inline are appended to a request, the server fails to enforce deny-list filtering and serves the target file with an HTTP 200 response.

This activity co-fires with related Vite access-control flaws:

• CVE-2025-30208 (CVSS 5.3): An @fs bypass using trailing query-string separators (?raw?? or ?import&raw??). Patched in 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10.
• CVE-2025-31125 (CVSS 5.3): Content exposure via ?inline&import or ?raw?import.
• CVE-2024-45811 (CVSS 4.8): File retrieval through ?import&raw bypasses.

With the exception of CVE-2025-31125, which appears on the CISA Known Exploited Vulnerabilities catalog, these CVEs remain unlisted on CISA KEV. However, the simplicity of the query-string trick makes exploitation trivial against any reachable server.

How the Vulnerability Works

Under default configurations, Vite binds to localhost. When developers expose the service by passing the --host flag, setting server.host, or misconfiguring Docker container port mappings, the development server becomes directly reachable over the local network or public internet.

The attack chain proceeds in three stages:

1. An unauthenticated scanner sends an HTTP GET request to the /@fs/ endpoint, referencing a sensitive file path and appending bypass query parameters.
2. The server processes the request, normalizes the path, and strips or misinterprets the query string during access validation, failing to trigger the server.fs.deny check.
3. The server returns the requested file in plaintext in the HTTP response body.

When targeted against configuration directories, this gives attackers immediate access to plaintext API secrets, database passwords, and cloud administrative credentials.

Observed Exploit Behavior

Telemetry indicates focused reconnaissance, with Information Leakage accounting for 32,010 events, followed by Predictable Resource Location (1,729) and Path Traversal (1,586).

Path and Syntax Variants. Probing centered on trailing-delimiter syntax combined with path traversal:

• GET /@fs/.env?raw??
• GET /@fs/root/.env?raw??
• GET /@fs/../.env?raw??
• GET /@fs/..%252f..%252f..%252f..%252froot/.env?raw??
• GET /@fs/..%252f..%252f..%252f..%252fproc/self/environ?raw (mailto:/@fs/..%252f..%252f..%252f..%252fproc/self/environ?raw)
• ??

The presence of double-encoded path traversal (%252f) indicates an attempt to bypass normalization routines in intermediate reverse proxies and WAFs.

Target File Paths. Rather than testing a single generic endpoint, the scanner cycled through a curated directory and credential wordlist:

• Environment configurations: .env, .env.local, .env.production, .env.development, .env.staging
• AWS credentials across user directories: /root/.aws/credentials, /home/ec2-user/.aws/credentials, /home/ubuntu/.aws/credentials, /home/node/.aws/credentials, /home/www-data/.aws/credentials, /home/admin/.aws/credentials, /home/debian/.aws/credentials, /var/www/.aws/credentials, /usr/src/app/.aws/credentials, /app/.aws/credentials
• AWS configurations and backups: .aws/config, .aws/credentials.backup, .aws/credentials.bak, .aws/sso/cache/, rootkey.csv, aws-exports.js, amplifyconfiguration.json
• Infrastructure as Code (IaC) state: terraform.tfstate, terraform.tfvars, .terraform/terraform.tfstate, serverless.yml, .serverless/serverless-state.json
• Azure profiles: .azure/credentials, .azure/accessTokens.json
• System memory and environment descriptors: /etc/passwd, /proc/self/environ, /proc/1/environ, /proc/self/cwd/.env

Probing /proc/self/cwd/.env demonstrates an understanding of the deployment stack, reading the active .env file relative to the running process without needing to guess the absolute web application path.

HTTP Characteristics. Requests utilized HTTP/1.0 with Connection: close, standard for automated scanning scripts. The operation rotated through forged User-Agent headers impersonating major web crawlers and AI bots:

• Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
• Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
• Mozilla/5.0 (compatible; GPTBot/1.4; +https://openai.com/gptbot)
• Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)
• Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)
• Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)

The requests also injected forged X-Forwarded-For and X-Real-IP values (such as 34.94.237.62 and 104.28.219.193) to circumvent IP-based access lists and complicate log analysis.

Threat Assessment

This activity represents an automated credential harvesting campaign operating across rented cloud infrastructure. The IP distribution shows high concentrations in Google Cloud Platform ranges (34.x and 35.x), spread across multiple regions:

The top individual sources, including 34.14.15.105, 34.16.200.129, and 34.11.196.206, produced parallel volumes across both CVE-2026-39364 and CVE-2025-30208 signatures. A small subset of 103 events from the same cluster also targeted CVE-2025-29927 (a Next.js middleware bypass), confirming that this scanner operates with a multi-framework probing library.

MITRE ATT&CK Mapping

Table 2: MITRE ATT&CK mapping

Top CVEs for August 2026

Table 3: Top 10 CVEs for August 2026

Trending CVEs for August

August 2026 saw broad escalation across the Top 10, with total exploitation activity concentrated on aging PHP and Microsoft Exchange flaws. CVE-2017-9841 held the top position at 4,201 attacks, but the headline movement came from CVE-2018-14028, which surged 3,258 attacks to climb three places into second. Three newcomers entered the table: CVE-2021-34523 (1,853 attacks), CVE-2024-44000 (1,079 attacks), and CVE-2016-4800 (1,078 attacks). Two Exchange ProxyShell-related CVEs fell out entirely, CVE-2022-41040 (previously #6) and CVE-2021-34473 (previously #7), both recording no exploitation activity this month, while CVE-2005-0869 dropped seven places from #8 to #15.

CVE-2018-14028

This WordPress plugin ZIP verification bypass was responsible for the single largest surge of the month, jumping by 3,258 attacks to a total of 4,102 and rising three ranks to #2. The scale of the increase could suggest a coordinated campaign targeting exposed WordPress installations for arbitrary file upload and subsequent code execution. Despite its comparatively moderate CVSS of 7.2, the ease of exploitation and prevalence of vulnerable plugins make this a priority. Defenders should audit plugin versions and monitor for anomalous ZIP uploads to admin endpoints.

CVE-2024-4577

Exploitation of the PHP CGI argument injection flaw on Windows also escalated, with a 2,612-attack increase pushing it three places up the ranks to #4. This CVSS 9.8 vulnerability enables remote code execution and remains highly attractive given the number of unpatched Windows PHP-CGI deployments. The sustained rise indicates active mass scanning and weaponization. Organizations running PHP in CGI mode on Windows should patch immediately or migrate off the CGI handler.

CVE-2021-34523

This Exchange privilege escalation flaw entered the Top 10 as a newcomer at #7 with 1,853 attacks and carries a CVSS of 9.0. Its arrival coincides with the disappearance of two other ProxyShell-chain CVEs, indicating attackers may be pivoting to alternate components of the same exploit chain. The continued targeting of on-premises Exchange underscores that these servers remain a favored entry point. Defenders should confirm full cumulative update coverage and hunt for post-exploitation web shell artifacts.

CVE-2022-41040

This Exchange SSRF vulnerability, part of the ProxyNotShell chain, dropped out of the Top 10 entirely after ranking #6 last month, recording no exploitation activity in August. Its exit alongside CVE-2021-34473 suggests a shift in adversary tooling rather than a decline in interest in Exchange overall. The concurrent rise of CVE-2021-26855, CVE-2022-41082, and the new CVE-2021-34523 shows attackers rotating across the Exchange exploit landscape. Teams should not treat this drop as risk reduction, as vulnerable Exchange servers remain heavily targeted.

CVE-2024-44000

The LiteSpeed Cache credential exposure flaw debuted at #9 with 1,079 attacks and a CVSS of 9.8. As one of the most widely deployed WordPress caching plugins, LiteSpeed Cache offers a large attack surface, and the exposure of protected credentials can enable account takeover and site compromise. Its immediate entry into the Top 10 signals rapid adoption by opportunistic scanners. Administrators should update the plugin and rotate any potentially exposed credentials.

Long Term Targeting Trends

Top CVEs

Figure 1: Six-month stacked graph of the top 5 CVEs.

CVE-2017-9841 remains the most-exploited vulnerability in Aug 2026 at 4,201 sessions, but this reflects a steep decline from its Nov 2025 peak of 27,075 and Jan 2026 level of 21,432. CVE-2018-20062 tracks a similar downward trajectory, falling to 3,482 in August from a Nov 2025 high of 22,635. The most notable August development is CVE-2018-14028, which surged to 4,102 sessions after intermittent activity, its highest monthly total since first appearing in Feb 2026. CVE-2024-4577 collapsed from a sustained 12,000 to 16,000 range across early 2026 to just 411 in Jul 2026 before partially recovering to 3,023, while CVE-2021-26855 held steady at 2,777. Despite the recent cooling of the two dominant PHP-based flaws, defenders should note that all five CVEs remain actively targeted and that the resurgence of CVE-2018-14028 and persistent CVE-2021-26855 activity confirm attackers continue to cycle through older, unpatched exposures; patching these legacy vulnerabilities should remain a standing priority rather than a completed task.

Attack Types Over Time

Figure 2: Evolution of attack types over 6 months

Predictable Resource Location dominated August 2026 with 945,081 events, a 153% surge from 373,758 in July and now the single largest category by monthly volume. Information Leakage climbed sharply to 620,931 from 249,977, a 148% increase, signaling intensified reconnaissance aimed at exposed files, config data, and error output. Command Execution (234,256, up 47%) and Server Side Code Injection (249,433, up 32%) remained persistent high-volume threats, together underscoring continued targeting of code-execution paths. The most striking proportional spikes came from Trojan/Backdoor/Spyware, up nearly 700% to 51,537 from 6,461, and Vulnerability Scan, up 184% to 8,711, both suggesting an escalation from probing toward payload delivery. Defenders should prioritize hardening against directory enumeration and information disclosure, tighten file access controls and error handling, and expand detection for injection and post-exploitation malware activity given the shifting mix toward active exploitation.

Top Source Countries

Figure 3: Source country geographical distribution

Attack traffic origins were heavily concentrated in a few key regions during August 2026. The United States was the primary source, exploding by 178% to over 4.5 million events. France was a distant second, though its own traffic more than doubled to 2.5 million events. Germany (1,359,473, up from 1,079,543) and Singapore (911,605, up from 614,777) recorded more moderate but consistent increases. China was the sole outlier, declining slightly to 816,154 from 858,403 and falling in the rankings. The concentration of traffic in US and French infrastructure, likely reflecting abuse of cloud and hosting providers, means blanket geo-blocking of these regions is impractical for most defenders. Prioritize granular ASN-level filtering and heightened monitoring of traffic from these top four sources rather than country-wide blocks.

Top Target Destinations

Figure 4: Destination target geographical distribution (normalized per sensor)

South Korea

South Korean sensors see a distinctive concentration of directory traversal and file-disclosure attempts alongside the ubiquitous web scripting and logging-library exploitation seen elsewhere. The path traversal activity here suggests attackers probing for exposed configuration and credential files as a reconnaissance step before deeper compromise.

Canada

Canada stands out as the leading target for newly disclosed framework authorization bypass and injection vulnerabilities, indicating adversaries prioritize this location for rapid weaponization of fresh research. The strong presence of recent-vintage exploitation shows attackers treating Canadian infrastructure as a fast-follow testing ground for emerging attack techniques.

United States

Sensors in the United States absorb the broadest attack mix, combining web scripting exploitation and deserialization-driven remote code execution with an elevated volume of mail and server-side authentication bypass and privilege escalation chaining. This layered targeting of enterprise-facing services distinguishes it as the primary proving ground for adversaries testing multi-stage intrusion tooling.

United Kingdom

The United Kingdom draws a mix of established web scripting attacks and a rising cadence of recently disclosed injection and remote code execution attempts. This blend signals adversaries actively refreshing their toolkits against UK-hosted services with current exploit variants.

Japan

Japan is distinguished by persistent probing of older server-side vulnerabilities, reflecting attacker assumptions that legacy and unpatched systems remain reachable there. This long-tail exploitation of dated flaws sits alongside the standard mix of web scripting and remote code execution attempts.

Conclusion

August 2026 telemetry demonstrated a clear escalation in automated scanning targeting exposed development tooling. The volume of Vite-related file-read attempts climbed from a baseline of 1,732 events over the prior three-month period to over 32,000 events in August alone.

The risk associated with this activity is determined primarily by environment exposure. Vite servers are built for local development rather than hardened production deployments. When development ports are inadvertently mapped to external interfaces in preview environments or staging containers, exploitation requires only a single unauthenticated HTTP request. The scanner's focus on cloud credentials, IaC states, and process memory files indicates that threat actors are prioritizing rapid access to cloud provider infrastructure over application-level compromise.

Organizations should focus on eliminating external exposure of development tools, inspecting perimeter boundaries for unauthenticated reverse-proxy paths, and filtering known exploitation patterns at the web application firewall layer.

Recommendations

For engineering and security teams managing Node.js and Vite applications:

1. Update Vite: Upgrade to versions 7.3.2, 8.0.5, or the latest patched point releases in the 4.5.x, 5.4.x, and 6.x branches.
2. Restrict network interfaces: Ensure development servers do not bind to external interfaces. Audit Docker compose configurations, Kubernetes ingress rules, and cloud security groups to ensure development ports (such as 5173) are never exposed directly to the public internet.
3. Deploy a modern WAF to block exploit patterns: A robust Web Application Firewall is the most effective defense against this and similar attacks. For example, F5 Advanced WAF includes signatures that proactively block Vite-related exploits and can be configured with custom rules to deny any request containing the /@fs/ path segment. These rules prevent the attack from ever reaching the vulnerable server.
4. Enforce strict reverse DNS verification for bots: Do not rely on raw User-Agent headers to whitelist search engine or AI crawler traffic. Validate crawler origin IPs via reverse DNS lookup before applying access bypasses.
5. Rotate exposed secrets: If an unpatched Vite development server was reachable from external networks during August 2026, treat local .env variables, AWS credentials, Azure access tokens, and Terraform state files as potentially compromised and rotate the associated keys immediately.