F5 Reports Surge in Attacks Targeting Vite and Associated Vulnerabilities
F5 Networks has recently provided insights into a troubling trend of cyber attacks exploiting both new and older vulnerabilities within the Vite framework. Security analysts at the company uncovered a significant increase in malicious activities centered around CVE-2026-39364, a newly identified vulnerability in Vite. Interestingly, the attackers are not solely focused on this recent flaw; they are also leveraging a range of earlier vulnerabilities associated with Vite, namely CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811. This information underscores a concerning pattern where attackers are adopting a multi-faceted approach, targeting various vulnerabilities at once in their efforts.
The research highlighted in F5’s blog post illustrates that the malicious actors are utilizing a specific scanning infrastructure to probe not only Vite vulnerabilities but also other frameworks. For instance, the same tools are being employed to seek out vulnerabilities such as a bypass in Next.js middleware. This indicates that the threat landscape is diverse and that attackers are broadening their focus beyond just a single framework or set of vulnerabilities.
F5’s findings are timely and important, particularly as they relate to the ongoing efforts to secure coding practices and the Software Development Lifecycle (SDLC). Awareness of vulnerabilities is crucial for developers aiming to fortify their applications against potential breaches. Despite the alarming rise in attacks specifically concerning Vite, it is noteworthy that F5 observed that these newer vulnerabilities did not make the top three most exploited CVEs within their honeypot environments. Instead, older flaws continued to dominate the list of exploited vulnerabilities.
The analysis indicates that the most targeted vulnerabilities included CVE-2017-9841, which is a critical remote code execution flaw in the PHPUnit testing framework that has been around for nearly a decade. This particular CVE reported a staggering 4,201 attempted attacks. Closely following it was CVE-2018-14028, a vulnerability in WordPress that allows for improper verification of plugins as valid ZIP files, which saw 4,102 attacks. In third place was CVE-2018-20062, associated with remote code execution in NotPHP’s NoneCms, which experienced 3,482 attempted exploits.
F5’s report does not only focus on the rise of new vulnerabilities but also touches on the classification and tracking of such vulnerabilities by security organizations. The company mentions that, aside from CVE-2025-31125—which has been documented in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog—none of the newly discovered Vite vulnerabilities have yet been included in this critical resource. This may imply a lag in recognition or a potential need for increased scrutiny as the cybersecurity community works to address these emerging threats.
In summary, the findings from F5 serve as a stark reminder of the rapidly evolving threat landscape, particularly as it pertains to web development frameworks like Vite. Organizations and developers must stay vigilant, continuously monitor for vulnerabilities, and make proactive adjustments to their security practices. The dual threat of both new and older vulnerabilities being exploited showcases the need for a comprehensive security strategy that encompasses ongoing education, threat detection, and incident response planning.
As cyber threats become more sophisticated, staying informed about vulnerabilities and employing best practices in secure coding will be paramount. By understanding and acting upon these vulnerabilities, organizations can better protect their assets and mitigate potential risks associated with cyber attacks. The current situation serves as a warning for developers and security teams alike to fortify their defenses and remain agile in their strategies as they navigate the complexities of securing their applications in a deeply interconnected digital ecosystem.