Team Cymru Sees Increased Risknet Traffic Targeting Ivanti and Citrix Devices
Summary
Team Cymru reports increased traffic from Risknet-tagged IPs toward VPN and edge devices, with Ivanti and Citrix showing notable spikes. The activity signals elevated risk but does not confirm exploitation.
Key points
- Team Cymru combined Risknet IP tags with NetFlow data to assess traffic toward selected VPN and edge-device technologies.
- Risknet-tagged traffic increased across four reviewed device types beginning in late February 2026.
- Ivanti devices saw a sharper rise in connection attempts in late March; Team Cymru said this did not confirm a new exploitation campaign.
- Citrix devices also saw a notable traffic spike shortly before Citrix reported critical vulnerability CVE-2026-3055, which may allow unauthenticated memory disclosure.
- The article cites earlier exploitation of vulnerabilities affecting Cisco, Ivanti, and Fortinet products as context for increased concern about edge devices.
- Team Cymru advises patching appliances, limiting internet exposure of management interfaces, and reviewing logs and telemetry for suspicious activity.
Article Details
- Event Type
- Threat-intelligence analysis of Risknet-tagged IP traffic contacting VPN and edge devices, alongside reports of actively exploited vulnerabilities affecting security products.
- Impact
- Team Cymru observed increased connections from Risknet-tagged IPs to several device types beginning in late February 2026, with Ivanti devices showing a sharper increase in late March and Citrix devices showing a significant spike. The activity indicates elevated risk but does not confirm a new exploitation campaign. The article also reports prior in-the-wild exploitation of CVE-2026-20131 and CVE-2026-24858, and active exploitation of CVE-2026-1281 and CVE-2026-1340.
CVE
CVE-2026-1281CVE-2026-1281 — Ivanti Endpoint Manager Mobile (EPMM) — Published January 29, 2026: Critical unauthenticated remote code execution/code injection vulnerability. Ivanti stated that a limited number of customers hadCVE-2026-1340CVE-2026-1340 — Ivanti Endpoint Manager Mobile (EPMM) — Published January 29, 2026: Critical unauthenticated remote code execution/code injection vulnerability disclosed alongside CVE-2026-1281. Vendor and publicCVE-2026-20131AWS published a report on a newly disclosed vulnerability affecting Cisco Firewall Management Center (CVE-2026-20131), with exploitation of its MadPot honeypot system detected in the wild. According to the AWS CTICVE-2026-24858CVE-2026-24858 — FortiOS / FortiGate— Published Januaruy 27, 2026 (also affecting FortiManager, FortiAnalyzer, FortiProxy, FortiSwitchManager, and FortiWeb when FortiCloud SSO is enabled): Critical authenticationCVE-2026-3055period. Shortly after concluding the data collection, Citrix reported a new critical vulnerability, CVE-2026-3055. This vulnerability allows unauthenticated attackers the ability to potentially leak memory, similar
People
Vendors
Amazon Web ServicesRecently, AWS published a report on a newly disclosed vulnerability affecting Cisco Firewall Management Center (CVE-2026-20131), with exploitation of its MadPot honeypot system detected in the wild. According to the AWSCiscoRecently, AWS published a report on a newly disclosed vulnerability affecting Cisco Firewall Management Center (CVE-2026-20131), with exploitation of its MadPot honeypot system detected in the wild. According to the AWSCitrixIvanti and Citrix, however, stood out.Fortinetwith a FortiCloud account and a registered device to access devices registered to other accounts. Fortinet stated that the issue had been exploited in the wild prior to disclosure.IvantiCVE-2026-1281 — Ivanti Endpoint Manager Mobile (EPMM) — Published January 29, 2026: Critical unauthenticated remote code execution/code injection vulnerability. Ivanti stated that a limited number of customers had
Products
Cisco Firewall Management CenterRecently, AWS published a report on a newly disclosed vulnerability affecting Cisco Firewall Management Center (CVE-2026-20131), with exploitation of its MadPot honeypot system detected in the wild. According to the AWSFortiAnalyzerCVE-2026-24858 — FortiOS / FortiGate— Published Januaruy 27, 2026 (also affecting FortiManager, FortiAnalyzer, FortiProxy, FortiSwitchManager, and FortiWeb when FortiCloud SSO is enabled): Critical authenticationFortiGateCVE-2026-24858 — FortiOS / FortiGate— Published Januaruy 27, 2026 (also affecting FortiManager, FortiAnalyzer, FortiProxy, FortiSwitchManager, and FortiWeb when FortiCloud SSO is enabled): Critical authenticationFortiManagerCVE-2026-24858 — FortiOS / FortiGate— Published Januaruy 27, 2026 (also affecting FortiManager, FortiAnalyzer, FortiProxy, FortiSwitchManager, and FortiWeb when FortiCloud SSO is enabled): Critical authenticationFortiOSCVE-2026-24858 — FortiOS / FortiGate— Published Januaruy 27, 2026 (also affecting FortiManager, FortiAnalyzer, FortiProxy, FortiSwitchManager, and FortiWeb when FortiCloud SSO is enabled): Critical authenticationFortiProxy— FortiOS / FortiGate— Published Januaruy 27, 2026 (also affecting FortiManager, FortiAnalyzer, FortiProxy, FortiSwitchManager, and FortiWeb when FortiCloud SSO is enabled): Critical authenticationFortiSwitchManager/ FortiGate— Published Januaruy 27, 2026 (also affecting FortiManager, FortiAnalyzer, FortiProxy, FortiSwitchManager, and FortiWeb when FortiCloud SSO is enabled): Critical authentication bypass/improper accessFortiWebJanuaruy 27, 2026 (also affecting FortiManager, FortiAnalyzer, FortiProxy, FortiSwitchManager, and FortiWeb when FortiCloud SSO is enabled): Critical authentication bypass/improper access control vulnerabilityIvanti Connect SecureThat does not, on its own, confirm a new exploitation campaign, but it does point to elevated risk and a need for heightened attention from operators of Ivanti Connect Secure and other internet-facing VPN appliances.Ivanti Endpoint Manager Mobile (EPMM)CVE-2026-1281 — Ivanti Endpoint Manager Mobile (EPMM) — Published January 29, 2026: Critical unauthenticated remote code execution/code injection vulnerability. Ivanti stated that a limited number of customers had