MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel
ctrlaltintel.com · 4 Mar 2026 · Licence: not cleared; local research copy only
CVEs this report names
13 CVEs- CVE-2025-55182Meta React Server Components Remote Code Execution VulnerabilityMeta · React Server ComponentsKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter5 reports99.8%Top 0.04%95.0priority
- CVE-2026-1731BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection VulnerabilityBeyondTrust · Remote Support (RS) and Privileged Remote Access (PRA)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter2 reports93.1%Top 0.17%91.0priority
- CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityFortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+2 more · 4 reports99.5%Top 0.06%88.8priority
- CVE-2025-52691SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type VulnerabilitySmarterTools · SmarterMailKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 report85.7%Top 0.28%88.8priority
- CVE-2026-1281Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityIvanti · Endpoint Manager Mobile (EPMM)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report98.7%Top 0.08%88.7priority
- CVE-2024-55591Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityFortinet · FortiOS and FortiProxyKEVRansomwarePublic exploitCritical · 9.8T1078Valid AccountsT1068Exploitation for Privilege Escalation+2 more · 1 report94.3%Top 0.15%83.7priority
- CVE-2025-5777Citrix NetScaler ADC and Gateway Out-of-Bounds Read VulnerabilityCitrix · NetScaler ADC and GatewayKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1555Credentials from Password Stores1 report>99.9%Top 0.02%82.1priority
- CVE-2025-54068Laravel Livewire Code Injection VulnerabilityLaravel · LivewireKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report96.3%Top 0.12%78.7priority
- CVE-2025-34291Langflow Origin Validation Error VulnerabilityLangflow · LangflowKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report92.8%Top 0.17%78.0priority
- CVE-2025-68613n8n Improper Control of Dynamically-Managed Code Resources Vulnerabilityn8n · n8nKEVPublic exploitHigh · 8.8T1078Valid AccountsT1059Command and Scripting Interpreter1 report99.0%Top 0.07%78.0priority
- CVE-2025-9316N-central unauthenticated sessionID generationN-able · N-centralPublic exploitMedium · 6.91 report37.4%Top 1.5%74.8priority
- CVE-2024-23113Fortinet Multiple Products Format String VulnerabilityFortinet · Multiple ProductsKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report61.7%Top 0.83%73.6priority
- CVE-2024-5559CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service…Schneider Electric · PowerLogic P5Medium · 6.11 report0.2%Top 92%11.0priority
Where it names them
CVE-2025-55182 Original (opens in a new tab) ↗
CVE-2025-55182 - React2Shell
CVE-2026-1731 Original (opens in a new tab) ↗
CVE-2026-1731 - BeyondTrust RCE
CVE-2022-42475 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2022-42475 - Fortinet FortiOS RCE
We observed the threat actor target multiple Fortinet related CVEs (CVE-2024-55591, CVE-2024-23113 & CVE-2022-42475) in attempts to gain command execution on Edge devices.
CVE-2025-52691 Original (opens in a new tab) ↗
CVE-2025-52691 - SmarterTools SmarterMail unrestricted file upload
CVE-2026-1281 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
MuddyWater additionally scanned using Nuclei to identify targets vulnerable to Ivanti CVE-2026-1281:
nuclei -l outputIPandport1983356674.txt -t nuclei-templates/http/cves/2026/CVE-2026-1281.yaml -o epmmoutput_fo_198.txt
nuclei -l outputIPandport362091310.txt -t nuclei-templates/http/cves/2026/CVE-2026-1281.yaml -o epmmoutput_362_fo.txt
CVE-2026-1281 - Ivanti Endpoint Manager Mobile (EPMM) code injection
CVE-2024-55591 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2024-55591 - Fortinet FortiOS authentication bypass
We observed the threat actor target multiple Fortinet related CVEs (CVE-2024-55591, CVE-2024-23113 & CVE-2022-42475) in attempts to gain command execution on Edge devices.
CVE-2025-5777 Original (opens in a new tab) ↗
CVE-2025-5777 - Citrix NetScaler memory leak
CVE-2025-54068 Original (opens in a new tab) ↗
CVE-2025-54068 - Laravel Livewire RCE
CVE-2025-34291 Original (opens in a new tab) ↗
CVE-2025-34291 - Langflow chained account takeover + RCE
CVE-2025-68613 Original (opens in a new tab) ↗
CVE-2025-68613 - n8n expression authenticated RCE
CVE-2025-9316 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2025-9316 - N-Central improper access control
MuddyWater also performed mass-exploitation of CVE-2025-9316, a vulnerability in SolarWinds N-central, a widely deployed RMM (Remote Monitoring & Management) platform used by MSPs.
CVE-2025-9316 exploitation
CVE-2024-23113 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2024-23113 - Fortinet FortiOS RCE
We observed the threat actor target multiple Fortinet related CVEs (CVE-2024-55591, CVE-2024-23113 & CVE-2022-42475) in attempts to gain command execution on Edge devices.
CVE-2024-5559 Original (opens in a new tab) ↗
We observed the threat actor had modified the watchTowr CVE-2024-5559 POC that would allow for RCE.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.