VulnerabilityhighExploited in the wild

251 Amazon-Hosted IPs Used in Exploit Scan Targeting ColdFusion, Struts, and Elasticsearch

The Hacker Newsby @TheHackersNewsMay 28, 2025 · 09:23 UTC (May 28, 2025)1 min read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2018-15961 CVE-2017-5638 CVE-2022-26134 CVE-2014-6271 CVE-2015-1427

Tags: cve-2018-15961 cve-2017-5638 cve-2022-26134 cve-2014-6271 cve-2015-1427 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2014-6271	Arbitrary Code Execution in GNU Bash (Shellshock)	—	100%	KEV	— KEV Jan 28, 2022
CVE-2015-1427	Sandbox Bypass RCE in Elasticsearch Groovy Scripting Engine	—	100%	KEV	— KEV Mar 25, 2022
CVE-2017-5638	Unauthenticated RCE in Apache Struts Jakarta Multipart parser	9.8	100%	KEVRansomwarePoC ×10	Mar 11, 2017 KEV Nov 3, 2021
CVE-2018-15961	Unrestricted File Upload Leading to RCE in Adobe ColdFusion	9.8	100%	KEVPoC	Sep 25, 2018 KEV Nov 3, 2021
CVE-2022-26134	Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center	9.8	100%	KEVRansomwarePoC ×2	Jun 3, 2022 KEV Jun 2, 2022

From the original article

1 min read at thehackernews.com

 Ravie Lakshmanan  May 28, 2025 Network Security / Vulnerability Cybersecurity researchers have disclosed details of a coordinated cloud-based scanning activity that targeted 75 distinct "exposure points" earlier this month. The activity, observed by GreyNoise on May 8, 2025, involved as many as 251 malicious IP addresses that are all geolocated to Japan and hosted by Amazon.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.