{"uuid": "e1d2bb68-40a0-4af6-a4ce-23854dcb113d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "seen", "source": "https://infosec.exchange/users/greynoise/statuses/117281541720935473", "content": "Two remote code execution flaws that CISA lists as known exploited turned up this week inside ordinary commodity crawling.\nAdversaries attempted CVE-2025-3248 and CVE-2026-0770 in Langflow, the AI application platform, at 3,968 and 4,770 connection attempts, both new to this brief series. The addresses behind them are the interesting part. Every one of them also carries a generic web crawling tag, roughly nine in ten collected environment files and enumerated WordPress installations, and about four in five requested repository configuration in the same window. Two hosting providers supply roughly 95% of those addresses, which means the source count measures how that traffic leaves those networks. A sweep of that shape reaches any exposed Langflow instance a general crawler touches.\nThe rest of the week concentrated the same way. Five of the ten highest-volume sources ran SSH enumeration and credential attacks from consumer broadband and mobile carrier networks, and four of them carried 36% of all alternative-port SSH crawling we observed. Two shared client fingerprints group those four across four separate networks, marking a common tool class. One address supplied more than half of all Remote Desktop crawling observed and three fifths of the credential attempts inside it.\nGreyNoise customers get the full weekly brief. Our public At The Edge one-page: https://www.greynoise.io/resources/at-the-edge-clear-091426", "creation_timestamp": "2026-09-16T15:58:27.086571Z"}