Greynoise

2026 GreyNoise Report Reveals New Exploitation Patterns

First seen 24 Feb 2026, 15:11 UTC • Greynoise

•22.3

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The 2026 GreyNoise State of the Edge Report indicates that over half of the most dangerous exploitation attempts against internet-facing infrastructure originated from IPs with no prior history in GreyNoise data. The analysis covered 2.97 billion malicious sessions over 162 days in the second half of 2025, highlighting significant gaps in edge defense strategies, particularly for remote code execution attacks.

How this analysis works

Timeline

1999-09-29

CVE-1999-0526 published

2025-07-01

Analysis period for the 2026 GreyNoise report begins

2025-12-31

Analysis period for the 2026 GreyNoise report ends

2026-02-24

2026 GreyNoise State of the Edge Report published

Attack Flow

21 entities, 46 inferred relationships (STIX 2.1).

Technique (6)

Botnet
Credential Stuffing
Zero-day Exploit
T1110 - Brute Force
T1133 - External Remote Services
T1203 - Exploitation for Client Execution

Organization (3)

Fortinet FortiClient EMS
Ivanti Policy Secure
Palo Alto Pan-os

Vulnerability (3)

CVE-1999-0526
CVE-2025-55182
Shellshock

Malware (1)

React2Shell

Affected Platform (8)

Ivanti Connect Secure
Cisco SSL VPN
Fortinet SSL VPN
GlobalProtect
Ollama
Oracle WebLogic
Palo Alto GlobalProtect
Ucloud

Relationships

React2Shell exploits CVE-1999-0526
React2Shell exploits CVE-2025-55182
React2Shell exploits Shellshock
CVE-1999-0526 targets Ivanti Connect Secure
CVE-1999-0526 targets Cisco SSL VPN
CVE-1999-0526 targets Fortinet SSL VPN
CVE-1999-0526 targets GlobalProtect
CVE-2025-55182 targets Ivanti Connect Secure
CVE-2025-55182 targets Cisco SSL VPN
CVE-2025-55182 targets Fortinet SSL VPN
CVE-2025-55182 targets GlobalProtect
Shellshock targets Ivanti Connect Secure
Shellshock targets Cisco SSL VPN
Shellshock targets Fortinet SSL VPN
Shellshock targets GlobalProtect
React2Shell targets Fortinet FortiClient EMS
React2Shell targets Ivanti Policy Secure
React2Shell targets Palo Alto Pan-os
Botnet targets Ivanti Connect Secure
Botnet targets Cisco SSL VPN
Botnet targets Fortinet SSL VPN
Botnet targets GlobalProtect
Credential Stuffing targets Ivanti Connect Secure
Credential Stuffing targets Cisco SSL VPN
Credential Stuffing targets Fortinet SSL VPN
Credential Stuffing targets GlobalProtect
Zero-day Exploit targets Ivanti Connect Secure
Zero-day Exploit targets Cisco SSL VPN
Zero-day Exploit targets Fortinet SSL VPN
Zero-day Exploit targets GlobalProtect
T1110 - Brute Force targets Ivanti Connect Secure
T1110 - Brute Force targets Cisco SSL VPN
T1110 - Brute Force targets Fortinet SSL VPN
T1110 - Brute Force targets GlobalProtect
T1133 - External Remote Services targets Ivanti Connect Secure
T1133 - External Remote Services targets Cisco SSL VPN
T1133 - External Remote Services targets Fortinet SSL VPN
T1133 - External Remote Services targets GlobalProtect
T1203 - Exploitation for Client Execution targets Ivanti Connect Secure
T1203 - Exploitation for Client Execution targets Cisco SSL VPN
T1203 - Exploitation for Client Execution targets Fortinet SSL VPN
T1203 - Exploitation for Client Execution targets GlobalProtect
React2Shell related to Ollama
React2Shell related to Oracle WebLogic
React2Shell related to Palo Alto GlobalProtect
React2Shell related to Ucloud

Continue Reading

Critical React2Shell RCE Vulnerability Exploited in the Wild RondoDox Botnet Targets React2Shell Flaw to Spread Malware Critical NGINX UI Vulnerability CVE-2026-33032 Under Active Exploitation AWS Warns of Data Exfiltration Risks from Outbound Traffic Blind Spots ChocoPoC Malware Targets Cybersecurity Researchers via Trojanized GitHub Exploits Rapid Exploitation of Vulnerabilities in 2025: Insights from Cisco Talos

2026 GreyNoise Report Reveals New Exploitation Patterns

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading