Skip to content

Back to the catalog

Agentless Threat Detection: Illuminating Cloud Blind Spots
wiz.ioarticle

Agentless Threat Detection: Illuminating Cloud Blind Spots

Wiz Research details how its Agentless Workload Detection uncovered active exploitation across a range of cloud/network appliances and services: FortiGate zero-day account creation (CVE-2026-24858), FortiBleed credential stuffing against ~75,000 devices, PAN-OS admin-account compromise (CVE-2026-0257) and CaptivePortal exploitation (CVE-2026-0300), a critical pre-auth BeyondTrust RCE (CVE-2026-1731), the memory-disclosure bug MongoBleed (CVE-2025-14847), Redis replication-abuse for RCE, a Zabbix instance compromised via default credentials, a Linux page-cache LPE called CopyFail, malicious npm package installs (@asyncapi/specs), and WordPress wp2shell webshells (CVE-2026-63030, CVE-2026-60137). It illustrates concrete detection logic (e.g. Redis replication target rules, unusual-executable HTTP access detections) built from agent-free log collection on virtual appliances that traditionally lacked EDR coverage.

TL;DR Wiz shows how agentless cloud workload telemetry caught real in-the-wild exploitation of FortiGate, PAN-OS, BeyondTrust, MongoDB, Redis, Zabbix, and WordPress, including several named 2026 CVEs.
Open original ↗

Organisations named here

  • MongoBleed

CVEs named here

  • CVE-2026-24858
  • CVE-2026-0257
  • CVE-2026-0300
  • CVE-2026-1731
  • CVE-2025-14847
  • CVE-2026-63030
  • CVE-2026-60137

Technologies named here

  • Wiz Agentless Workload Detection
  • FortiGate devices
  • Wiz ASM
  • FortiOS
  • Threat Detection Rules
  • Redis
  • @asyncapi/specs
  • Redis suspicious replication target configured
  • PAN-OS VPN gateway
  • Redis module loaded from unusual path
  • Attack Detected and Prevented by Redis
  • BeyondTrust Remote Support and Privileged Remote Access
  • Zabbix
  • Linux
  • MongoDB Server
  • WordPress Core
  • Wiz
  • FortiGate
  • npm
  • WordPress
  • MongoDB

Techniques named here

  • Zero-day exploitation to create local super-user accounts
  • Credential Stuffing
  • Configuration theft and credential decryption
  • Redis replication abuse
  • Cryptojacking via misconfigured Redis
  • Software supply chain attack via malicious npm packages
  • Admin account compromise via VPN gateway vulnerability
  • CaptivePortal URI exploitation
  • Unauthenticated administrative command execution
  • Default credential exploitation
  • Lateral movement via monitoring tool triggers
  • Linux page cache exploitation
  • Unauthenticated memory leak exploitation
  • Webshell deployment via wp2shell

Threat actors named here

  • FortiBleed campaign
  • wp2shell
  • CopyFail
  • FortiBleed

Related in Blue Team & Detection