F5 Labs Sensor Intel research, reported by BleepingComputer on 14 September 2026, describes a sustained August 2026 mass-scanning campaign against internet-exposed Vite development servers harvesting cloud credentials and IaC state. Activity is anchored on CVE-2026-39364, an unauthenticated server.fs.deny / file-read bypass via query parameters such as ?raw, ?import&raw, or ?import&url&inline on /@fs/ requests (GitHub advisory GHSA-v2wj-q39q-566r, published 6 April 2026).

GitHub rates CVSS 4.0 8.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N); F5 also cites CVSS 7.5 High for the same CVE. Affected: Vite 7.1.0–7.3.1 and 8.0.0–8.0.4 (also vite-plus ≤0.1.15). Patched: 7.3.2, 8.0.5, and current patched lines on older branches per vendor. F5 honeypots saw ~807 session-grouped attacks and ~32,000 raw events in August, wordlisting .env files, AWS/Azure credential paths, Terraform/serverless state, and /proc environ; scanners also reused older Vite bypasses CVE-2025-30208, CVE-2025-31125 (CISA KEV), and CVE-2024-45811.

Exposure usually comes from --host / server.host or Docker port maps (often 5173). Mitigations: upgrade; do not expose dev ports; block /@fs/; rotate secrets if an unpatched Vite was reachable. (sources: F5 Labs; GitHub advisory; BleepingComputer)

Correction (28 Oct 2026): the card is now dated 11 September 2026, the date F5 Labs' report shows ("9/11/2026"). A 27 Oct correction wrongly said F5 Labs' report showed no date and dated the card 14 September from BleepingComputer.

GitHub's April 2026 advisory covers the underlying flaw and does not set the date of this campaign report. (source: F5 Labs)