This weekend, our Initial Access Intelligence offering surpassed 1,000 VulnCheck-authored exploits, each of which anchors a powerful defensive artifact package designed to give security teams and cyber operators insight into attacker capabilities from exposure through execution and post-exploitation. We’re marking the milestone by announcing Initial Access Intelligence Community: A free, open collection of VulnCheck-authored exploits and detection artifacts published on GitHub and available via the VulnCheck API. Initial Access Community joins other VulnCheck community offerings, including our free, industry-leading KEV list, VulnCheck NVD++, the VulnCheck Exploit Database (XDB), and our coordinated vulnerability disclosure service. The VulnCheck community counts more than 23,000 members.
What Initial Access Community includes
To say that public proof-of-concept (PoC) code can be unreliable, incomplete, or unsafe to run is a colossal understatement. Under 50% of all GitHub exploits VulnCheck reviewed in 2026 have been legitimate repos targeting real vulnerabilities; fake, non-functional, or straight-up malicious PoCs are the norm now rather than the exception. Reliable exploit code and detection rules tend to arrive long after exploitation has started, meaning teams lack a safe way to confirm whether a host is exploitable and to confidently detect CVE exploits already occurring in the wild. Initial Access Community entries include:
- A VulnCheck-authored exploit written with our open-source go-exploit framework; exploits come with robust target validation and version scanning capabilities wherever possible
- A vulnerable Docker environment for safe testing
- A PCAP of successful exploitation
- Snort and Suricata rules, along with Sigma or YARA rules where supported
- Shodan, Censys, FOFA, ZoomEye, and/or GreyNoise queries to assess exposure
The community repository comprises 40 exploits chosen by our team, all of which have demonstrable real-world attacker utility. New exploits and detection artifacts will be published on Mondays. Each exploit appears in the community repository at least 21 days after it is available to VulnCheck customers. The repository is licensed under Apache 2.0; community contributions can be made under 0BSD.
Get started here: https://github.com/vulncheck-oss/initial-access-community
Initial Access Community uses the same repository layout, deliverable structure, and YAML as commercial Initial Access Intelligence. Detection engineers, threat hunters, blue teams, and red teams can test each exploit against its Docker target, deploy the detections, and check exposure with one set of verified community artifacts. Those who need access to VulnCheck’s full exploit and detection offering in real time can upgrade by changing only a URL and a token.
Initial Access Community: Threat-Oriented Coverage
Initial Access community exploits were chosen in part based on real-world threat activity targeting the associated CVEs.
- WordPress CVE-2026-63030: VulnCheck’s exploit represented the first commercially available weaponized exploit code for “WP2shell” when it hit in July 2026. It has since been exploited by Red Heron (PRC) and Winter Vivern (RU) and now boasts more than 75 known exploits and thousands of Canary detections.
- n8n CVE-2025-68613: VulnCheck added an exploit on January 8, 2026, following the vulnerability’s publication in late December 2025. The Zerobot botnet began exploiting the flaw in mid-January, and the vulnerability was also listed among CVEs that Iran-linked MuddyWater tried to scan or exploit. VulnCheck Target Intelligence finds more than 11,000 n8n hosts online.
- ProFTPD CVE-2026-42167: The VulnCheck research team shipped a weaponized exploit for this pre-auth SQL injection vulnerability in ProFTPD on May 7, 2026. By June 1, we’d started seeing Canary hits — unsurprising given ProFTPD’s large deployment footprint. The vulnerability is still not listed on CISA KEV.
What 1,000 Initial Access exploits cover
Initial Access community contains a small subset of exploits from VulnCheck’s commercial Initial Access Intelligence offering, which focuses primarily on remotely exploitable vulnerabilities that do not require user interaction. Our goal is to cover the vulnerabilities attackers care about — and whenever possible, to cover them before exploitation begins. Find more information on Initial Access Intelligence here.
- Exploited in the wild: More than two-thirds of Initial Access Intelligence vulnerabilities (680+ CVEs) are on VulnCheck KEV, and 37% have exploitation evidence observed directly by VulnCheck Canaries. CISA KEV tracks 338 CVEs VulnCheck has covered.
- Pre-exploitation signal: For 220+ CVEs, VulnCheck-authored Initial Access exploits and detection artifacts were available before any public proof-of-concept code. More than 54% of Initial Access exploits were available on or before the day exploitation began (or target vulnerabilities that are not yet exploited).
- Threat actor usage: More than 300 CVEs covered in Initial Access Intelligence have been exploited by at least one known threat actor, ransomware family, or botnet — spanning prominent threat clusters like Red Heron (CN), UAT-8616 (Unattributed), Static Kitten (IR), Voodoo Bear (RU), and Labyrinth Chollima (DPRK).
- Vulnerability classes: OS command injection, code injection, and path traversal are the most common types of weaknesses targeted, together representing 34% of exploits, though classes like insecure deserialization (7.4%) and various subcategories of memory corruption flaws (5.75%) are also common.
- Technology types: VulnCheck Initial Access exploits commonly cover network edge devices like routers, VPNs, firewalls, application delivery controllers, cameras, and NAS devices. A growing percentage (80+ exploits) of our coverage is for AI technologies, such as LLM and agent frameworks, AI gateways, model-serving platforms, and MCP servers. Other common technologies covered include popular open-source frameworks and libraries; core operating systems; and enterprise productivity, IT management, and security software.
About VulnCheck
VulnCheck empowers organizations to transcend the challenges of vulnerability prioritization. Our suite of solutions provides product managers, PSIRT teams, and threat hunters with the tools required for accelerated, high-precision operations and infinite efficiency. Recognizing the industry-wide necessity for superior data velocity and accuracy, we deliver high-fidelity insights to the market. We remain committed to surfacing critical intelligence on vulnerability exploitation and emerging trends, leveraging our unique dataset to support the practitioner community. Sign up for the VulnCheck community today to get free access to our VulnCheck KEV, enjoy our comprehensive vulnerability data, and request a trial of our Canary Intelligence, Target Intelligence, and Exploit & Vulnerability Intelligence products. Weekly Initial Access Intelligence exploits and detections can be found here.