Loading story…
GreyNoise reported a sudden, sustained step-function collapse in global Telnet traffic beginning around 21:00 UTC on 2026-01-14, dropping from roughly 65k–74k hourly sessions to about 11k within two hours (an ~83% decline) and then holding at a lower baseline. GreyNoise assessed the change as a structural shift in Internet “plumbing” (not normal scanner churn or a telemetry issue) and noted the drop preceded public disclosure of CVE-2026-24061 (posted to oss-security on 2026-01-20) and CISA’s subsequent addition of the CVE to the Known Exploited Vulnerabilities (KEV) catalog (by 2026-01-26), suggesting the traffic collapse and exploitation activity may be related.
Despite the global reduction, Asia-Pacific networks showed comparatively weaker suppression of Telnet, leaving continued exposure from insecure, legacy Telnet services on devices such as consumer-grade routers. GreyNoise data cited by Dark Reading indicated inconsistent national-level filtering in the region—Taiwan blocked ~77% of Telnet sessions (the strongest in the region), while India (~70%), Japan (~65%), and China (~59%) reduced traffic less aggressively—contrasting with countries such as Ukraine and Canada that reportedly blocked Telnet traffic entirely. The net effect is that while backbone-level controls appear to have materially reduced global Telnet scanning and session volume, organizations operating in lagging jurisdictions may still face elevated risk from Telnet-exposed assets and exploitation tied to CVE-2026-24061.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
On February 10, 2026, GreyNoise published its analysis concluding the January 14 collapse most likely reflected infrastructure-level port 23 filtering by one or more transit providers rather than a normal decline in scanning. The researchers noted the depressed and volatile post-drop environment persisted through at least February 10 and hypothesized, without proof, that advance notice of the vulnerability may have prompted the filtering.
Following disclosure, GreyNoise reported active exploitation of the telnetd authentication-bypass flaw, with exploitation peaking around early February before tapering. The activity reinforced the urgency of patching to GNU Inetutils 2.7-2 or later or disabling Telnet entirely.
Four days after the public advisory, CISA added CVE-2026-24061 to its Known Exploited Vulnerabilities catalog. The KEV listing established a federal remediation deadline of February 16, 2026 for affected organizations.
On January 20, 2026, a public advisory disclosed CVE-2026-24061, a critical authentication-bypass flaw in GNU Inetutils telnetd. The bug allows USER argument injection that can enable a root login bypass via "-f root," and was described as trivial to exploit.
Beginning after the January 14 traffic collapse, GreyNoise saw 18 high-volume autonomous systems drop to zero observed Telnet sessions and five countries—Zimbabwe, Ukraine, Canada, Poland, and Egypt—vanish entirely from its Telnet dataset. Major cloud providers were largely unaffected or even increased, suggesting the impact was concentrated in specific transit paths or filtering domains.
Around 21:00 UTC on January 14, 2026, GreyNoise observed a sudden step-function drop in global Telnet (TCP/23) activity, with sessions falling sharply within hours and daily volume dropping from about 914,000 to roughly 373,000. The change appeared sustained rather than transient, indicating a major shift in Internet-wide Telnet reachability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcego.theregister.com
Open sourcelabs.greynoise.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-32746**, a critical `telnetd` vulnerability in **GNU Inetutils** that allows an unauthenticated remote attacker to achieve **root remote code execution** by exploiting a buffer overflow in the **LINEMODE SLC (Set Local Characters)** option handler. The flaw affects GNU Inetutils `telnetd` through version `2.7`, carries a **CVSS 9.8**, and can be triggered during the initial Telnet handshake on **port 23** before any login prompt appears, requiring no credentials, no user interaction, and no special network position. The issue was discovered and reported by **Dream** on March 11, 2026, and GNU maintainers reportedly confirmed the finding, with a fix expected by **April 1, 2026**. Both reports warn that successful exploitation can lead to full system compromise because `telnetd` often runs with elevated privileges, enabling follow-on activity such as persistent backdoors, data theft, and lateral movement. The risk is especially acute in **legacy environments** where Telnet remains in use, including **ICS/OT, PLC, SCADA, and some government systems**, even though public reporting has not yet indicated active exploitation in the wild.
Jul 1, 2026
A critical vulnerability tracked as **CVE-2026-32746** was disclosed in **GNU InetUtils `telnetd`** affecting version **2.7 and earlier**, enabling **pre-authentication remote code execution** through a buffer overflow in the **LINEMODE SLC handler**. The flaw stems from a missing bounds check in the `add_slc` function, which can trigger an out-of-bounds memory write during the Telnet handshake before the login prompt is shown. Security reporting said a remote unauthenticated attacker could exploit the bug to execute code as **root**, resulting in full system compromise. The issue was rated **CVSS 9.8** and public proof-of-concept exploit code was reported as available, increasing the likelihood of exploitation against exposed Telnet services. Advisories urged organizations to treat internet-accessible `telnetd` instances as high risk and apply mitigations until patches are available, including restricting access to trusted IP addresses, blocking **TCP port 23**, or disabling Telnet entirely where it is not operationally required.
Jul 24, 2026
GNU InetUtils disclosed a high-severity authentication bypass in `telnetd`, tracked as **CVE-2026-24061**, that allows a remote attacker to obtain a root shell by abusing how the daemon invokes `/usr/bin/login`. In affected versions **1.9.3 through 2.7**, `telnetd` passes the client-controlled `USER` environment variable without proper sanitization, enabling an attacker to supply values such as `-f root` and trigger login’s authentication-bypass behavior. The flaw was reportedly introduced by a 2015 code change, remained present for more than a decade, and carries a **CVSS 9.8** severity rating. GNU InetUtils published patches to sanitize variable expansions used in the login invocation, including a broader hardening change after the initial fix, and advised administrators to upgrade or apply the available patches immediately. Where patching is not possible, maintainers and CSIRT.SK recommended disabling `telnetd`, restricting Telnet access to trusted IP addresses, considering a `login(1)` implementation that rejects the `-f` flag, and reviewing logs for signs of compromise. CSIRT.SK also reported that **GreyNoise observed exploitation attempts in the wild**, increasing the urgency for exposed systems.
Jul 24, 2026