Reported by 7 outlets

Timeline

1. original reporting

   1. Basic Information Original Title: Cloud Takeover: Mass Scanning for Exposed Vite... # security # threatintel # software # coding # develo

   dev.to · 28d ago · September 15th, 2026

   1. Basic Information Original Title: Cloud Takeover: Mass Scanning for Exposed Vite... # security # threatintel # software # coding # develo

   via Mastodon https://dev.to/anoymask/vite-cve-2026-39364-exploring-cloud-secrets-from-exposed-development-servers-43fc

2. update from bleepingcomputer.com

   Hackers target exposed Vite dev servers to steal AWS, Azure secrets

   bleepingcomputer.com · 29d ago · September 14th, 2026

   A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments. The operation leverages an exploit for CVE-2026-39364, a high-severity vulnerability that allows bypassing file read/access controls in Vite versions 7.1.0 through 7.3.2, as well as the 8.x branch before 8.0.5. The flaw was disclosed on April 7 and allows an unauthenticated attacker to manipulate query parameters in an HTTP GET request to bypass security restrictions and retrieve files in plaintext from locations that should normally be out of their reach. Technology company F5 detected the attacks through its honeypot sensors, observing more than 800 attacks and approximately 32,000 raw events over a month. “When specific parameters such as ?raw, ?import&raw, or ?import&url&inline are appended to a request, the server fails to enforce deny-list filtering and serves the target file with an HTTP 200 response,” F5 explains. After breaching a system, the scanning focused on valuable secrets by using extensive wordlists for the following types of data: .env, .env.production, .env.local, and other environment files AWS credential files from several possible home directories AWS configuration files and credential backups Azure credentials and access tokens Terraform state and variable files Serverless configuration/state /proc/self/environ, /proc/1/environ, and /proc/self/cwd/.env /etc/passwd F5 notes that the opera

3. mentioned by www.bleepingcomputer.com

   Hackers target exposed Vite dev servers to steal AWS, Azure secrets https:// bleepingcomputer.com/news/security/ hackers-target-exposed-vite

   www.bleepingcomputer.com · 29d ago · September 14th, 2026

4. update from bleepingcomputer.com

   Hackers target exposed Vite dev servers to steal AWS, Azure secrets

   bleepingcomputer.com · 29d ago · September 14th, 2026

   submitted by /u/AsterPrivacy [link] [comments]

   via reddit r/cybersecurity: Hackers target exposed Vite dev servers to steal AWS, Azure secrets

5. mentioned by securityonline.info

   The Vite development server vulnerability CVE-2026-39364 is exploited in mass scanning for credential harvesting. F5 Labs logged 32,000 even

   securityonline.info · 29d ago · September 15th, 2026

6. update from gbhackers.com

   Mass Scanning Targets Exposed Vite Servers to Steal AWS Keys and Azure Tokens

   gbhackers.com · 28d ago · September 15th, 2026

   In August 2026, automated threat activity targeting exposed Vite development servers increased significantly. Attackers aimed to extract cloud credentials, environment files, and infrastructure state data by exploiting a critical file-read vulnerability known as CVE-2026-39364. Honeynet telemetry recorded 807 session-grouped attacks and approximately 32,000 raw events during the monthly analysis period. This campaign shows how quickly […] The post Mass Scanning Targets Exposed Vite Servers to Steal AWS Keys and Azure Tokens appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

7. update from cyberpress.org

   Hackers Mass-Scan Exposed Vite Servers to Steal AWS Credentials and Terraform Secrets

   cyberpress.org · 28d ago · September 15th, 2026

   F5 Labs honeynet telemetry recorded 807 session-grouped attacks and roughly 32,000 raw events during August 2026, marking a sharp rise from only 1,732 Vite-related events observed across the prior three months. Vite uses the internal /@fs/ route during development to serve files from the local filesystem. Hackers Mass-Scan Exposed Vite Servers Although the framework includes deny-list protections for sensitive files such as .env configurations, certificates, and source code, CVE-2026-39364 lets attackers bypass those controls through manipulated query parameters. Observed exploit requests appended values including ?raw , ?import&raw , and ?import&url&inline to file paths. The server can then mishandle access validation and return restricted files with an HTTP 200 response. Attackers also used traversal variations to evade path-normalization controls, including double-encoded slash characters. Example probes included requests for /.env , /root/.env , /proc/self/environ , and paths using %

8. mentioned by beyondmachines.net

   Mass-Scanning Campaign Targets Exposed Vite Development Servers to Steal Cloud Credentials A mass-scanning campaign is exploiting a file dis

   beyondmachines.net · 27d ago · September 16th, 2026

9. mentioned by cybersecurefox.com

   CVE-2026-39364: Mass scanning of Vite servers 🔗 https:// cybersecurefox.com/en/cve-2026 -39364-mass-scanning-vite-servers-cloud-credentials-

   cybersecurefox.com · 24d ago · September 19th, 2026