Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers

Cybersecurity researchers from F5 Labs and BleepingComputer disclosed a mass-scanning campaign targeting internet-exposed Vite development servers. Exploiting CVE-2026-39364, attackers bypass server.fs.deny to siphon sensitive data, including cloud credentials and configurations from Amazon Web Services (AWS) and Microsoft Azure instances, alongside infrastructure state files. F5 observed approximately 32,000 events targeting these vulnerabilities. This critical threat allows unauthorized actors to read sensitive information, potentially leading to full cloud takeovers via exposed Vite endpoints.