Grafana Flaw CVE-2021-43798 Sees Surge in Exploits

Security researchers have detected a sudden and coordinated surge in exploitation attempts targeting a known Grafana path traversal vulnerability, CVE-2021-43798. Over a single day, 110 unique malicious IP addresses were observed scanning for vulnerable servers, with attacks focused on endpoints in just three geographic areas. The majority of the attack traffic originated from a single region, with most of the source IPs appearing for the first time on the day of the attack. The uniform targeting patterns and shared network fingerprints suggest a coordinated campaign using a common exploit kit rather than random scans. This activity highlights the ongoing risk posed by unpatched, older vulnerabilities, which are often used as an initial entry point in multi-stage attacks.