cyber.hendryadrian.com
Security News · wiz.io

Wiz Highlights Agentless Detection of Attacks on Cloud Appliances and Workloads

· Original article ↗

Summary

Wiz says its agentless workload detection uncovered exploitation and suspicious activity across virtual appliances, Redis, npm packages, MongoDB, Zabbix, and WordPress, giving security teams visibility into workloads that do not support traditional EDR agents.

Key points

  • Wiz says agentless collection of workload and device logs helped investigate attacks on virtual appliances that do not support traditional EDR agents.
  • Reported FortiGate activity included exploitation of CVE-2026-24858, credential stuffing, and theft of device configurations containing reversibly encrypted credentials.
  • The company describes Redis replication abuse that can load malicious modules for remote code execution, and says it has detections for suspicious replication and module loading.
  • Wiz reports identifying malicious npm package activity through installation logs and correlating it with wider workload behavior.
  • The article cites observed exploitation of PAN-OS and BeyondTrust vulnerabilities, as well as MongoBleed, and activity consistent with Linux CopyFail exploitation.
  • A Zabbix instance with default credentials reportedly allowed arbitrary code execution and potential lateral movement; a WordPress webshell used an unauthenticated REST endpoint to execute supplied commands.
  • Wiz recommends enabling agentless workload detection and log ingestion; FortiGate log collection also requires non-OS disk scanning.

Article Details

Event Type
Security research report on agentless detection of exploitation targeting cloud workloads and virtual appliances.
Impact
Wiz reports detecting exploitation and suspicious activity involving FortiGate devices, Redis, malicious npm packages, PAN-OS, BeyondTrust Remote Support and Privileged Remote Access, Zabbix, MongoDB Server, and WordPress. Reported activity includes account creation, credential and configuration theft, remote code execution, memory-data exposure, and deployment of a PHP webshell.

CVE

CVE-2025-14847MongoBleed, tracked as CVE-2025-14847, is a critical unauthenticated memory leak vulnerability in MongoDB Server. The vulnerability affects MongoDB’s handling of zlib-compressed network messages, allowing remoteCVE-2026-0257PAN-OS: we observed actors successfully logging into admin accounts via CVE-2026-0257 in the PAN-OS VPN gateway. In another case our research team identified a spike in traffic to the CaptivePortal URI just few daysCVE-2026-0300case our research team identified a spike in traffic to the CaptivePortal URI just few days after CVE-2026-0300 disclosure, confirming the exploitation trend.CVE-2026-1731BeyondTrust Remote Support (CVE-2026-1731): This is a critical pre-authentication Remote Code Execution (RCE) vulnerability affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) software with aCVE-2026-24858CVE-2026-24858 Exploitation: We observed attackers exploiting this zero-day to create local super-user accounts and modify different settings, enabling lateral movement and greater impact.

Vendors

WizEDR agents, they have historically been a massive visibility gap for security teams. Over the past months, Wiz’s Agentless Workload Detection has fundamentally changed this pattern. Not only does it provide critical

Products

Agentless Workload Detectionhistorically been a massive visibility gap for security teams. Over the past months, Wiz’s Agentless Workload Detection has fundamentally changed this pattern. Not only does it provide critical visibility intoBeyondTrust Remote SupportBeyondTrust Remote Support (CVE-2026-1731): This is a critical pre-authentication Remote Code Execution (RCE) vulnerability affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) software with aFortiGateThe FortiGate Campaign TrailFortiOSBecause FortiOS uses reversible encryption for stored credentials, these stolen configs allowed actors to decrypt LDAP service accounts and VPN pre-shared keys to facilitate lateral movement.MongoDB ServerMongoBleed, tracked as CVE-2025-14847, is a critical unauthenticated memory leak vulnerability in MongoDB Server. The vulnerability affects MongoDB’s handling of zlib-compressed network messages, allowing remotePAN-OSCritical Vulnerabilities at Scale: PAN-OS and BeyondTrustPrivileged Remote AccessRemote Code Execution (RCE) vulnerability affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) software with a near-maximum CVSS score of 9.9.RedisRedis: Beyond Simple Cron JobsWordPressWordPress: Webshell deployed via wp2shellZabbixCase Study: The Zabbix API & Default Credentials

Related Articles