Patch/Configuration Management

Experts warn that social engineering lets attackers take advantage of even the lesser-rated vulnerabilities.

Chinese-speaking cybercrime operation UAT-8099 has targeted unsecured Internet Information Services servers across Asia, particularly in Thailand and Vietnam, as part of an attack campaign that commenced late last year, reports Cyber Security News.

The attacks exploit misconfigured MongoDB instances accessible without restriction.

The vulnerabilities primarily stem from memory safety, parsing robustness, and resource handling issues.

CVE-2026-1281 and CVE-2026-1340 have CVSS scores of 9.8 and have already been exploited.

Cisco Talos reported that exploited vulnerabilities were responsible for nearly 40% of all intrusions in the fourth quarter of 2025.

The patches address four critical vulnerabilities: CVE-2025-40552 and CVE-2025-40554, which allow remote authentication bypass, CVE-2025-40553, a remote code execution (RCE) flaw due to untrusted data deserialization, and CVE-2025-40551, another RCE vulnerability.

The flaws affect the platform’s expression engine and Python Code Node.