CVE
CVE-2026-39364
Vite has a `server.fs.deny` bypass with queries
Exploitation IoCs 5
IP 104[.]28[.]219[.]193
IP 34[.]11[.]196[.]206
IP 34[.]14[.]15[.]105
IP 34[.]16[.]200[.]129
IP 34[.]94[.]237[.]62
MITRE ATT&CK TTPs 1
Source Articles
Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers
A mass-scanning campaign has been exploiting CVE-2026-39364, a high-severity vulnerability in Vite, to extract sensitive data from internet-exposed development servers. The flaw allows unauthenticated attackers to bypass file access restrictions by manipulating query parameters, enabling them to retrieve cloud credentials, environment configurations, and infrastructure state files from AWS and Azure environments. Attackers use spoofed User-Agent headers and forged X-Forwarded-For headers to evade detection, with significant malicious traffic originating from Google Cloud Platform IP ranges in the U.S., Belgium, the Netherlands, Singapore, and Taiwan.
hacker-news Sep 15, 2026
Hackers target exposed Vite dev servers to steal AWS, Azure secrets
Hackers are conducting a mass-scanning campaign targeting internet-exposed Vite development servers, exploiting CVE-2026-39364 to bypass file access controls and steal sensitive cloud credentials from AWS and Azure environments. The attackers use specific query parameters to retrieve environment files, cloud credentials, Terraform configurations, and system information. The activity has been observed originating from IP addresses in the United States, Belgium, and the Netherlands, with attackers leveraging Google Cloud infrastructure for evasion.
bleeping-computer Sep 14, 2026