Loading story…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added the Grafana path traversal vulnerability, CVE-2021-43798, to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the ongoing risk this flaw poses to organizations. CVE-2021-43798 is a directory traversal vulnerability affecting Grafana versions 8.0.0-beta1 through 8.3.0, which allows unauthenticated attackers to access files outside of intended directories by manipulating HTTP requests to the /public/plugins/<plugin-id>/ path. This vulnerability enables threat actors to read sensitive files such as /etc/passwd, configuration files, OAuth tokens, and internal databases containing user and data source information. Since its disclosure in December 2021, the vulnerability has been actively exploited in the wild, with persistent scanning and attacks targeting internet-facing Grafana servers. The risk is particularly acute for critical infrastructure, cloud environments, and enterprise deployments where Grafana is widely used for observability and monitoring. Publicly available exploit code has facilitated ongoing exploitation, making unpatched systems especially vulnerable. CISA’s decision to add this vulnerability to the KEV catalog is based on confirmed evidence of active exploitation, underscoring the significant risk it poses to the federal enterprise and beyond. Under Binding Operational Directive (BOD) 22-01, all Federal Civilian Executive Branch (FCEB) agencies are required to remediate this vulnerability by a specified due date to protect their networks from active threats. CISA also strongly encourages all organizations, not just federal agencies, to prioritize remediation of KEV catalog vulnerabilities as part of their vulnerability management programs. The agency’s alert emphasizes that path traversal vulnerabilities like CVE-2021-43798 are frequent attack vectors for malicious cyber actors. Organizations are advised to immediately upgrade affected Grafana instances to patched versions to mitigate the risk of compromise. The inclusion of this vulnerability in the KEV catalog serves as a warning to both public and private sector entities about the ongoing exploitation and the need for urgent action. CISA will continue to monitor and update the KEV catalog as new evidence of exploitation emerges. The agency provides additional resources and fact sheets to help organizations understand the requirements and best practices for addressing known exploited vulnerabilities. The move reflects CISA’s broader strategy to reduce the significant risk posed by actively exploited vulnerabilities across the federal enterprise and the wider cybersecurity ecosystem. Organizations that fail to remediate this vulnerability remain at heightened risk of data breaches and system compromise. The continued exploitation of CVE-2021-43798 demonstrates the importance of timely patching and proactive vulnerability management. CISA’s alert and catalog update are intended to drive immediate action and raise awareness of the persistent threat posed by this Grafana vulnerability.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
CISA added Grafana path traversal vulnerability CVE-2021-43798 to its Known Exploited Vulnerabilities catalog, indicating evidence of active exploitation. The addition was publicly announced in CISA's October 9, 2025 alert and subsequently reported by other outlets.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcesecurityaffairs.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
On September 28, 2025, a significant surge in exploitation attempts targeting the Grafana path traversal vulnerability, CVE-2021-43798, was detected by GreyNoise. This vulnerability allows attackers to perform arbitrary file reads on vulnerable Grafana instances, posing a serious risk to organizations using the affected software. Over the course of a single day, GreyNoise observed 110 unique IP addresses attempting to exploit this flaw, all of which were classified as malicious. The majority of these IPs originated from Bangladesh, with 107 IPs traced to that country, while the remaining sources included China and Germany. Of the Bangladesh-based IPs, 105 specifically targeted endpoints in the United States, indicating a focused attack pattern. The destinations of the attacks were limited to three countries: the United States, Slovakia, and Taiwan, with the U.S. being the primary target. The attack traffic followed a consistent ratio across these countries, approximately 3:1:1 for the U.S., Slovakia, and Taiwan, respectively. Analysis of the TCP and HTTP fingerprints revealed that multiple tools were used in the attacks, but all were directed at the same set of targets, suggesting a coordinated campaign rather than random, opportunistic exploitation. Two notable IP addresses from China, both belonging to CHINANET-BACKBONE, were highlighted for their activity on the day of the surge. These IPs were only active on September 28 and were not observed before or after this date, further supporting the theory of a coordinated, time-bound operation. The exploitation activity had been relatively quiet in the months leading up to this event, making the sudden spike particularly noteworthy. GreyNoise's Global Observation Grid (GOG) was instrumental in detecting and analyzing the surge, providing valuable intelligence on the geographic and technical characteristics of the attack. The convergence of attack patterns, source geographies, and tooling points to shared tasking or a common target list among the attackers. Organizations using Grafana are advised to ensure that their systems are patched against CVE-2021-43798 and to monitor for suspicious activity from the identified malicious IPs. The incident underscores the ongoing threat posed by unpatched vulnerabilities in widely used open-source software. Security teams should remain vigilant for similar coordinated exploitation attempts, especially following periods of low activity. The rapid mobilization of a large number of malicious IPs in a single day demonstrates the attackers' ability to coordinate and execute targeted campaigns efficiently. This event highlights the importance of global threat intelligence sharing and proactive vulnerability management. The attack serves as a reminder that even older vulnerabilities can become the focus of renewed exploitation efforts. Organizations should review their exposure to Grafana and implement appropriate network defenses to mitigate the risk of similar attacks.
Jul 23, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding five new security flaws that are currently under active exploitation. The vulnerabilities include CVE-2021-21311 affecting Adminer, CVE-2025-20352 impacting Cisco IOS and IOS XE, CVE-2025-10035 in Fortra GoAnywhere MFT, CVE-2025-59689 in Libraesva Email Security Gateway, and CVE-2025-32463 in Sudo. The Adminer flaw is a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to manipulate URL parameters, potentially enabling unauthorized access to internal resources and facilitating lateral movement within networks. The Cisco IOS and IOS XE vulnerability is a stack-based buffer overflow in the SNMP subsystem, which can be exploited by sending crafted SNMP packets, leading to denial of service or remote code execution as root, depending on attacker privileges. Fortra GoAnywhere MFT is affected by a critical deserialization vulnerability in its License Servlet, which could allow attackers to execute arbitrary code. Libraesva ESG suffers from a command injection vulnerability, and Sudo is impacted by a flaw involving the inclusion of functionality from an untrusted control sphere. CISA’s Product Security Incident Response Team (PSIRT) has confirmed that these vulnerabilities are being actively exploited in the wild. The addition of these flaws to the KEV Catalog is based on credible evidence of exploitation, and CISA has issued a Binding Operational Directive (BOD) 22-01 requiring Federal Civilian Executive Branch (FCEB) agencies to remediate these vulnerabilities by specified deadlines. The directive aims to reduce significant risk to federal networks, but CISA also strongly urges all organizations, not just federal agencies, to prioritize remediation of these vulnerabilities as part of their vulnerability management programs. The vulnerabilities span a range of critical systems, including database management tools, network operating systems, email security gateways, and managed file transfer platforms, highlighting the broad attack surface targeted by malicious actors. The Adminer SSRF vulnerability, with a CVSS score of 7.2, affects versions 4.0.0 to just before 4.7.9, while the Cisco IOS/IOS XE flaw, with a CVSS score of 7.7, impacts all devices with SNMP enabled. The Fortra GoAnywhere MFT vulnerability is rated as critical with a CVSS score of 10.0, underscoring the urgency of remediation. CISA’s ongoing updates to the KEV Catalog reflect the evolving threat landscape and the need for organizations to remain vigilant against actively exploited vulnerabilities. Organizations are encouraged to consult the KEV Catalog regularly and implement timely patches to mitigate the risk of compromise. The inclusion of these vulnerabilities in the KEV Catalog serves as a warning to both public and private sector entities about the heightened risk posed by these flaws. Failure to address these vulnerabilities could result in significant operational disruptions or unauthorized access to sensitive systems. CISA’s alert emphasizes the importance of proactive vulnerability management and cross-sector collaboration to defend against active cyber threats.
Jun 29, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog to include several new security flaws that have been actively exploited in the wild. The newly added vulnerabilities span a wide range of products and platforms, including GNU Bash, Smartbedded Meteobridge, Juniper ScreenOS, Jenkins, Samsung mobile devices, and several legacy products from Mozilla, Microsoft, Linux, and Oracle. Among the most notable is the GNU Bash command injection flaw (CVE-2014-6278), a Shellshock-related vulnerability that allows remote attackers to execute arbitrary code on affected Linux and Unix systems. Juniper ScreenOS is affected by an improper authentication vulnerability (CVE-2015-7755), which can grant attackers administrative access via TELNET or SSH. Jenkins is impacted by a remote code execution bug (CVE-2017-1000353) that enables unauthenticated attackers to bypass deserialization safeguards through crafted Java objects. The Smartbedded Meteobridge device is vulnerable to a command injection issue (CVE-2025-4008), allowing remote, unauthenticated users to execute root-level commands through its web interface. Samsung mobile devices are at risk due to an out-of-bounds write flaw (CVE-2025-21043) in libimagecodec.quram.so, which can be exploited remotely for arbitrary code execution. CISA also added vulnerabilities such as CVE-2010-3765 (Mozilla products), CVE-2010-3962 (Microsoft Internet Explorer), CVE-2011-3402 and CVE-2013-3918 (Microsoft Windows), CVE-2021-22555 (Linux Kernel), CVE-2021-43226 (Microsoft Windows), and CVE-2025-61882 (Oracle E-Business Suite), all of which have evidence of active exploitation. Federal agencies have been directed to remediate these vulnerabilities by a specified deadline to comply with Binding Operational Directive (BOD) 22-01, which mandates timely mitigation of known exploited vulnerabilities. The directive is designed to reduce significant risk to the federal enterprise by ensuring that actively exploited vulnerabilities are addressed promptly. While BOD 22-01 is mandatory for Federal Civilian Executive Branch agencies, CISA strongly encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities as part of their vulnerability management programs. The addition of these vulnerabilities underscores the persistent threat posed by both legacy and modern software flaws, and highlights the importance of continuous monitoring and rapid response to newly discovered exploits. CISA’s ongoing updates to the KEV Catalog serve as a critical resource for organizations seeking to defend against active cyber threats. The agency’s alert emphasizes that these vulnerabilities are frequent attack vectors for malicious actors and pose significant risks if left unaddressed. Organizations are advised to consult the KEV Catalog regularly and implement recommended mitigations to protect their networks. The inclusion of both recent and older vulnerabilities in the catalog reflects the reality that unpatched legacy systems remain a significant target for attackers. CISA’s proactive approach aims to drive widespread remediation efforts across both public and private sectors. The agency will continue to update the KEV Catalog as new evidence of exploitation emerges, reinforcing the need for vigilance and timely patching in cybersecurity operations.
Jun 29, 2026