Ruleset Update Summary - 2026/10/27 - v11320

Ruleset Updates
1

Summary:

3 new OPEN, 44 new PRO (3 + 41)

Added rules:

Open:

  • 2072578 - ET WEB_SPECIFIC_APPS Wordpress wp-login.php Rest API JSONP Reflected Cross Site Scripting Attempt M1 (CVE-2026-64638) (web_specific_apps.rules)
  • 2072579 - ET WEB_SPECIFIC_APPS Wordpress wp-login.php Rest API JSONP Reflected Cross Site Scripting Attempt M2 (CVE-2026-64638) (web_specific_apps.rules)
  • 2072580 - ET WEB_SPECIFIC_APPS Wordpress wp-login.php Rest API JSONP Reflected Cross Site Scripting Attempt M3 (CVE-2026-64638) (web_specific_apps.rules)

Pro:

  • 2868935 - ETPRO EXPLOIT Synacor Zimbra Collaboration RestFilter Servlet Local File Inclusion (CVE-2025-68645) (exploit.rules)
  • 2868936 - ETPRO EXPLOIT PlaySMS Server-Side Template Injection (CVE-2020-8644) (exploit.rules)
  • 2868937 - ETPRO EXPLOIT Unraid template.php Code Injection (CVE-2020-5847) (exploit.rules)
  • 2868938 - ETPRO EXPLOIT Adminer Drivers ErrorHandling Server-Side Request Forgery (CVE-2021-21311) (exploit.rules)
  • 2868939 - ETPRO EXPLOIT Gitlab CI Lint API Server-Side Request Forgery (CVE-2021-22175) (exploit.rules)
  • 2868940 - ETPRO EXPLOIT Synacor Zimbra WebExZimlet Server-Side Request Forgery (CVE-2020-7796) (exploit.rules)
  • 2868941 - ETPRO EXPLOIT Grandstream UCM6202 SQL Injection (CVE-2020-5722) (exploit.rules)
  • 2868942 - ETPRO EXPLOIT QNAP Photo Station Improper Access Control (CVE-2019-7192) (exploit.rules)
  • 2868943 - ETPRO EXPLOIT Dassault Systemes Delmia Apriso FlexNet_Employees schema Missing Authorization (CVE-2025-6205) (exploit.rules)
  • 2868944 - ETPRO EXPLOIT Atlassian Confluence Hard-coded Credentials (CVE-2022-26138) (exploit.rules)
  • 2868945 - ETPRO EXPLOIT Synacor Zimbra Collaboration Cross-Site Scripting (CVE-2022-27926) (exploit.rules)
  • 2868946 - ETPRO EXPLOIT Synacor Zimbra Collaboration Suite Content Location Cross-Site Scripting (CVE-2018-6882) (exploit.rules)
  • 2868947 - ETPRO EXPLOIT Pi-hole Authenticated Web DHCP Static Lease Remote Code Execution (CVE-2020-8816) (exploit.rules)
  • 2868948 - ETPRO EXPLOIT Zoho ManageEngine ADSelfService Plus Custom Script Command Injection (CVE-2022-28810) (exploit.rules)
  • 2868949 - ETPRO EXPLOIT Apache Spark Command Injection (CVE-2022-33891) (exploit.rules)
  • 2868950 - ETPRO EXPLOIT rConfig ajaxAddTemplate OS Command Injection (CVE-2020-10221) (exploit.rules)
  • 2868951 - ETPRO EXPLOIT LG N1A1 NAS Remote Command Execution (CVE-2018-14839) (exploit.rules)
  • 2868952 - ETPRO EXPLOIT React Native Metro Development Server Openurl OS Command Injection (CVE-2025-11953) (exploit.rules)
  • 2868953 - ETPRO EXPLOIT Ubiquiti stainfo.cgi OS Command Injection (CVE-2010-5330) (exploit.rules)
  • 2868954 - ETPRO EXPLOIT D-Link Router set_prohibiting macaddr Command Injection (CVE-2025-29635) (exploit.rules)
  • 2868955 - ETPRO EXPLOIT NETGEAR Multiple WAP Devices macAddress Command Injection (CVE-2016-1555) (exploit.rules)
  • 2868956 - ETPRO EXPLOIT Red Hat JBoss Enterprise Application Platform web-console Information Disclosure (CVE-2010-1428) M1 (exploit.rules)
  • 2868957 - ETPRO EXPLOIT Red Hat JBoss Enterprise Application Platform web-console Information Disclosure (CVE-2010-1428) M2 (exploit.rules)
  • 2868958 - ETPRO EXPLOIT Zimbra Collaboration Blind Memcached CRLF Injection (CVE-2022-27924) (exploit.rules)
  • 2868959 - ETPRO EXPLOIT Microsoft Windows NTLM Hash Disclosure Spoofing (CVE-2025-24054) M1 (exploit.rules)
  • 2868960 - ETPRO EXPLOIT Microsoft Windows NTLM Hash Disclosure Spoofing (CVE-2025-24054) M2 (exploit.rules)
  • 2868961 - ETPRO WEB_SPECIFIC_APPS Unraid strpos Authentication Bypass (CVE-2020-5849) M1 (web_specific_apps.rules)
  • 2868962 - ETPRO WEB_SPECIFIC_APPS Unraid strpos Authentication Bypass (CVE-2020-5849) M2 (web_specific_apps.rules)
  • 2868963 - ETPRO WEB_SPECIFIC_APPS Unraid strpos Authentication Bypass (CVE-2020-5849) M3 (web_specific_apps.rules)
  • 2868964 - ETPRO WEB_SPECIFIC_APPS Unraid strpos Authentication Bypass (CVE-2020-5849) M4 (web_specific_apps.rules)
  • 2868965 - ETPRO WEB_SPECIFIC_APPS Unraid strpos Authentication Bypass (CVE-2020-5849) M5 (web_specific_apps.rules)
  • 2868966 - ETPRO WEB_SPECIFIC_APPS Unraid strpos Authentication Bypass (CVE-2020-5849) M6 (web_specific_apps.rules)
  • 2868967 - ETPRO WEB_SPECIFIC_APPS Unraid strpos Authentication Bypass (CVE-2020-5849) M7 (web_specific_apps.rules)
  • 2868968 - ETPRO WEB_SPECIFIC_APPS Unraid strpos Authentication Bypass (CVE-2020-5849) M8 (web_specific_apps.rules)
  • 2868969 - ETPRO WEB_SPECIFIC_APPS QNAP Photo Station Externally Controlled Reference (CVE-2022-27593) (web_specific_apps.rules)
  • 2868970 - ETPRO WEB_CLIENT Google Chromium Intents Redirection (CVE-2021-38000) (web_client.rules)
  • 2868971 - ETPRO WEB_SPECIFIC_APPS Zyxel ZLD Hard-Coded zyfwp Credentials (CVE-2020-29583) (web_specific_apps.rules)
  • 2868972 - ETPRO EXPLOIT Roundcube Webmail timezone File Disclosure (CVE-2017-16651) (exploit.rules)
  • 2868973 - ETPRO HUNTING TryNodeRAT CnC Fetch Node Resources (hunting.rules)
  • 2868974 - ETPRO HUNTING TryNodeRAT CnC Fetch JS (hunting.rules)
  • 2868975 - ETPRO MALWARE TryNodeRAT CnC JS Payload (malware.rules)

Disabled and modified rules:

  • 2845474 - ETPRO PHISHING Successful Bank of America Phish 2020-11-12 (phishing.rules)