Listen to this Post
Introduction: The Hidden Battle Inside Modern Infrastructure
In today’s digital world, organizations are no longer protected simply by securing applications and endpoints. The biggest battles increasingly happen inside the infrastructure layer — routers, firewalls, VPN gateways, networking equipment, firmware, servers, and edge devices that quietly keep businesses connected.
As cybercriminal groups and state-backed attackers continue targeting these critical components, security teams face a growing challenge: which vulnerabilities should be fixed first?
Traditional vulnerability management often depends heavily on CVSS severity scores. However, attackers do not choose targets based only on numerical ratings. They focus on what is exposed, reachable, easy to exploit, and valuable after compromise.
To address this growing gap, Eclypsium has introduced InfraTrust, a cybersecurity knowledge base and monthly reporting initiative designed to help organizations identify the infrastructure vulnerabilities that pose the greatest real-world danger.
The first InfraTrust Pulse report for July 2026 analyzed dozens of infrastructure security advisories from major technology vendors and highlighted a critical message: organizations must prioritize vulnerabilities based on exploitability and exposure, not just severity numbers.
Eclypsium InfraTrust: A New Approach to Vulnerability Prioritization
Eclypsium’s InfraTrust platform was created to solve one of the biggest problems in enterprise security: vulnerability overload.
Large organizations receive thousands of security alerts every month. New CVEs appear constantly across networking equipment, firmware components, cloud infrastructure, and enterprise appliances. Security teams often struggle to determine which issues require immediate action.
InfraTrust changes the approach by analyzing:
How easily a vulnerability can be exploited.
Whether attackers can exploit it remotely.
Whether authentication is required.
Whether the affected device is exposed to the internet.
Whether active exploitation has already been observed.
Whether the vulnerability affects critical infrastructure.
Instead of asking:
“Which vulnerability has the highest CVSS score?”
InfraTrust encourages organizations to ask:
“Which vulnerability gives attackers the fastest path into our environment?”
The First InfraTrust Pulse Report Reveals Serious Infrastructure Risks
The inaugural July 2026 InfraTrust Pulse report, created by Eclypsium Principal Security Researcher Paul Asadoorian, reviewed:
61 infrastructure security advisories.
14 major technology vendors.
6 critical advisories.
26 remotely exploitable unauthenticated vulnerabilities.
The report identified multiple vulnerabilities that require urgent attention because they affect devices commonly positioned at the edge of corporate networks.
These include:
VPN appliances.
Firewalls.
Load balancers.
Network switches.
Data-center management systems.
AI infrastructure hardware.
Many of these systems are attractive targets because compromising them can provide attackers with direct access to enterprise networks.
Why CVSS Scores Alone Are No Longer Enough
For years, organizations have relied on CVSS ratings to determine vulnerability priority.
A vulnerability rated 9.8 or 10.0 usually receives immediate attention, while lower-rated vulnerabilities may be delayed.
However, Eclypsium argues that this approach creates dangerous blind spots.
A vulnerability with a CVSS score of 7.0 that affects an internet-facing VPN appliance and requires no authentication may represent a much greater threat than a 9.8 vulnerability that requires local administrator access.
Attackers care about:
Accessibility.
Simplicity.
Reliability.
Impact.
They do not care about vulnerability scoring systems.
The cybersecurity industry is increasingly moving toward risk-based vulnerability management, where organizations focus on realistic attack scenarios instead of theoretical severity.
State-Sponsored Hackers Increasingly Target Infrastructure Devices
The focus on infrastructure security comes during a period of increased attacks against network equipment.
Government-backed threat groups from Russia and China have repeatedly targeted:
Routers.
VPN gateways.
Firewalls.
Telecommunications systems.
Edge infrastructure.
Groups such as Volt Typhoon and Salt Typhoon have demonstrated that infrastructure devices can provide attackers with long-term access and stealthy persistence.
Unlike traditional malware campaigns, infrastructure attacks often allow attackers to remain hidden for extended periods because compromised network devices sit outside normal endpoint monitoring systems.
The Most Urgent Vulnerabilities Highlighted by Eclypsium
SonicWall SMA1000: Active Exploitation Detected
SonicWall SMA1000 remote-access appliances were among the highest-priority issues identified.
Two vulnerabilities:
CVE-2026-15409
CVE-2026-15410
were actively exploited by attackers.
Threat actors used these flaws to deploy custom malware before public disclosure.
The danger comes from the role these devices play. Remote-access appliances are designed to provide external connectivity into corporate environments, making them valuable targets.
A compromised SMA1000 device can become a gateway into internal systems.
Fortinet FortiSandbox: Command Injection Risks
Eclypsium also highlighted Fortinet FortiSandbox vulnerabilities.
The affected issues include:
CVE-2026-39808
CVE-2026-25089
These vulnerabilities allow unauthenticated command injection.
After exploitation activity was detected, the vulnerabilities were added to CISA’s Known Exploited Vulnerabilities catalog.
The important lesson is that even older vulnerabilities can become urgent when attackers begin actively using them.
Security teams cannot assume that a vulnerability is safe simply because it was disclosed months earlier.
Dell Networking OS10 and SmartFabric Manager: Critical Data Center Exposure
Dell networking products were another major focus.
The affected technologies include:
EMC Networking OS10.
SmartFabric Manager.
Eclypsium highlighted that modern network operating systems are not simple firmware packages. Many are complex Linux-based environments containing large amounts of software.
This creates a significant attack surface.
A compromised network management system can allow attackers to manipulate traffic, monitor communications, or move deeper into enterprise environments.
F5 BIG-IP: Internet-Facing Infrastructure Remains a Prime Target
F5 BIG-IP devices are widely used for:
Application delivery.
Load balancing.
Traffic management.
Enterprise access control.
Because these devices often sit directly on the internet perimeter, vulnerabilities inside them are especially dangerous.
Eclypsium warned that unauthenticated vulnerabilities affecting these systems should receive immediate attention.
Attackers frequently scan the internet for exposed edge devices, making delayed patching extremely risky.
Juniper Networks: Availability Threats Against Core Infrastructure
Juniper vulnerabilities identified in Junos OS affect routers and switches used in enterprise and service-provider environments.
Several issues allow remote attackers to crash affected devices.
Although denial-of-service vulnerabilities may appear less severe than remote code execution flaws, they can still create major consequences.
A successful attack against core routing infrastructure can:
Interrupt business operations.
Disconnect customers.
Disrupt cloud connectivity.
Affect critical services.
NVIDIA BlueField and ConnectX: Protecting the AI Infrastructure Layer
One of the most interesting parts of the report is its focus on NVIDIA infrastructure.
BlueField DPUs and ConnectX SmartNICs are increasingly used in:
Artificial intelligence data centers.
Cloud environments.
High-performance computing platforms.
As AI infrastructure expands, attackers are likely to increasingly target the hardware and networking components supporting AI workloads.
Security teams must now consider hardware acceleration systems as part of their cybersecurity strategy.
Deep Analysis: Infrastructure Vulnerabilities and Enterprise Attack Paths
How Attackers Identify Vulnerable Infrastructure
Attackers typically begin by mapping exposed assets.
Example reconnaissance commands:
nmap -sV -p 443,22,80 target-domain.com
This helps identify:
Open ports.
Running services.
Possible vulnerable technologies.
Checking Network Device Exposure
Security teams can review internet exposure using:
shodan search "product:F5 BIG-IP"
or:
censys search "services.http.response.headers.server"
Attackers use similar techniques to locate vulnerable devices.
Firmware and Hardware Security Challenges
Infrastructure vulnerabilities are often harder to fix because updates depend on:
Hardware manufacturers.
Firmware validation.
Vendor release cycles.
Enterprise testing procedures.
A software vulnerability may receive a patch within days.
A firmware vulnerability may remain exposed for months.
Example Security Workflow
Organizations should:
1. Identify exposed infrastructure 2. Map vendor advisories 3. Confirm exploitation status 4. Prioritize internet-facing systems 5. Apply emergency patches 6. Monitor for compromise indicators
Why Attackers Prefer Edge Devices
Edge devices provide:
Network visibility.
Authentication pathways.
Traffic control.
Access into internal environments.
A compromised firewall or VPN appliance can sometimes provide more value than compromising a single employee computer.
What Undercode Say:
Infrastructure security has entered a new phase where traditional vulnerability management is no longer enough.
The biggest mistake organizations make is treating every vulnerability as equal.
They are not.
A vulnerability inside an isolated internal server is not the same as a vulnerability inside an internet-facing VPN gateway.
Attackers understand this difference better than many defenders.
The release of InfraTrust reflects a major shift happening across cybersecurity.
The industry is moving away from simple vulnerability counting and toward practical risk measurement.
Security teams are overwhelmed by thousands of CVEs every year.
The challenge is no longer finding vulnerabilities.
The challenge is knowing which ones can become real attacks.
Infrastructure devices deserve special attention because they sit at strategic points inside organizations.
Routers, firewalls, load balancers, and management platforms are the foundation of modern businesses.
When these systems fail, the impact is often much larger than a single compromised endpoint.
The rise of state-sponsored attacks against infrastructure proves that attackers are changing their strategies.
They are not only stealing information.
They are targeting the systems that control communication, access, and operations.
AI expansion makes this issue even more important.
As companies build larger AI environments, new infrastructure layers are becoming attractive targets.
Security teams must protect not only applications but also the hardware and networking systems powering them.
Organizations should adopt a continuous security mindset.
Waiting for monthly patch cycles may no longer be enough.
Critical infrastructure vulnerabilities require immediate visibility and rapid response.
The future of cybersecurity will depend on understanding attacker behavior.
Risk-based prioritization will replace simple severity scoring.
Companies that identify their most exposed assets before attackers do will have a significant advantage.
InfraTrust represents an important evolution in vulnerability intelligence.
The message is clear:
The most dangerous vulnerability is not always the highest-rated one.
It is the one that gives attackers the easiest path inside.
✅ Fact: Eclypsium launched InfraTrust as a vulnerability intelligence initiative focused on infrastructure security.
The platform is designed to analyze infrastructure-related security advisories and help organizations prioritize risks.
✅ Fact: Infrastructure devices are increasingly targeted by advanced threat groups.
Recent cyber campaigns have shown that routers, VPN appliances, and edge devices are valuable targets for state-sponsored attackers.
✅ Fact: CVSS scores alone cannot represent complete cybersecurity risk.
Real-world risk depends on exposure, exploit availability, authentication requirements, and business impact.
❌ Claim Check: Every critical CVSS vulnerability is automatically the most dangerous vulnerability.
This is incorrect because attackers often prioritize easier-to-exploit medium-rated vulnerabilities.
Prediction
(+1) Risk-based vulnerability management will become the standard approach for enterprise cybersecurity.
Organizations will increasingly move beyond CVSS scores and adopt systems that combine exploit intelligence, asset exposure, and real attack data.
Security platforms similar to InfraTrust will likely become essential as companies struggle with growing vulnerability volumes.
(+1) Infrastructure security spending will increase significantly.
As AI data centers, cloud platforms, and edge networks expand, businesses will invest more heavily in protecting hardware-level and network-level systems.
(-1) Organizations that continue relying only on traditional patching schedules will face increasing cyber risks.
Attackers are moving faster than many security teams, and delayed responses to exposed infrastructure vulnerabilities may lead to major breaches.
(+1) Hardware and firmware security will become a central cybersecurity priority.
Future attacks will not only target software applications but also the physical and virtual infrastructure supporting modern digital services.
▶️ Related Video (74% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
