Mass Scanning Campaign Targets Exposed Vite Servers for Cloud Credentials

• •CVE-2026-39364 allows unauthenticated access to sensitive files on Vite servers.
• •F5 Labs detected over 800 attack sessions targeting exposed Vite servers in August 2026.
• •Attackers used extensive wordlists to extract AWS and Azure credentials from vulnerable systems.

In August 2026, a mass-scanning campaign targeted internet-exposed Vite development servers to steal sensitive cloud credentials and configuration files from AWS and Azure. The attackers exploited CVE-2026-39364, a high-severity vulnerability allowing unauthenticated access to restricted files via manipulated query parameters. F5 Labs reported over 800 attack sessions and approximately 32,000 raw events linked to this operation. The scanning utilized extensive wordlists to extract various sensitive files, including .env files, AWS credentials, and Terraform state files. Most malicious activity originated from the United States, Belgium, and the Netherlands, with attackers employing Google Cloud IPs for evasion. F5 recommends updating Vite to the latest version and blocking access to vulnerable endpoints. The vulnerability was disclosed on April 7, 2026, and has been actively exploited since then.