# GTIG: AI-Era Vulnerability Discovery and Exploitation Surge — In-the-Wild Exploitation of BeyondTrust CVE-2026-1731, LiteLLM CVE-2026-42271 and Langflow CVE-2026-5027

> Google Threat Intelligence Group reports disclosures doubled (5,045 in Jan 2026 to 10,477 in Jul 2026) and exploited vulnerabilities rose to 18/month (Jan-Aug 2026) versus 10.5/month in 2025, with 141 distinct exploited vulnerabilities already exceeding 2025's 127. Exploitation is confirmed against AI middleware (LiteLLM CVE-2026-42271, Langflow CVE-2026-5027) and BeyondTrust CVE-2026-1731, which saw multiple threat clusters within days of disclosure deploying SNOWLIGHT, SPARKRAT and cryptominers.

- **Published:** 2026-09-30T00:00:00Z
- **Last reviewed:** 2026-09-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2818
- **ID:** TL-2026-2818
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-1731, CVE-2026-42271, CVE-2026-5027, CVE-2025-3248, CVE-2026-48710

## Description

Google Threat Intelligence Group (GTIG) published 'Vulnerability Discovery and Exploitation Trends in the AI Era' on 2026-09-30. Monthly CVE disclosures roughly doubled from 5,045 (Jan 2026) to 10,477 (Jul 2026), peaking at 10,740 in Aug 2026. High-risk disclosures rose from 131 to 350 (+167%). Exploitation averaged 18 vulnerabilities/month in Jan-Aug 2026 (10.5/month in 2025); 141 distinct vulnerabilities were exploited in eight months versus 127 in all of 2025, only about 0.23% of disclosures (1 in 431). Zero-days averaged 11/month (8/month in 2025), spiked to 22 in Aug 2026 and made up 62% of exploited vulnerabilities. Edge and security appliances accounted for 14% of exploited flaws (65% of them High/Critical threat risk) because unauthenticated management interfaces sit outside EDR visibility; enterprise directory and collaboration products accounted for 11%. Mass-disclosure events (TOTOLINK router firmware, Apr-May 2026; Oracle and Linux kernel drivers, Jun-Aug 2026) inflated volume.

GTIG reports that AI-discovered vulnerabilities skew toward more consequential classes: 50% lead to remote code execution versus 26% for non-AI-discovered bugs. CVE-2026-1731 (BeyondTrust Remote Support / Privileged Remote Access, unauthenticated OS command injection, discovered autonomously by Hacktron AI) was first exploited about 4 days after disclosure and by 5 additional threat clusters within 7 days, deploying SNOWLIGHT, SPARKRAT and cryptominers, with privilege escalation, lateral movement and data exfiltration. Unit 42 independently documented exploitation via the WebSocket-exposed thin-scc-wrapper script (bash arithmetic-context injection in the remoteVersion parameter), leading to SparkRAT, VShell, web shells (including a China Chopper/AntSword-style aws.php), temporary admin account takeover, SimpleHelp/AnyDesk, Cloudflare Tunnel, Ligolo-ng, Meterpreter, Nezha agent, OAST-based DNS exfiltration and PostgreSQL dumps, across financial, legal, technology, higher-education, retail and healthcare victims in the US, France, Germany, Australia and Canada. BeyondTrust cloud customers were patched 2026-02-02; the advisory and self-hosted patches followed 2026-02-06; CISA added the CVE to KEV on 2026-02-13.

GTIG also tracks AI middleware exploitation. CVE-2026-42271 (BerriAI LiteLLM 1.74.2 through 1.83.6, patched in 1.83.7) is command injection in the MCP preview endpoints POST /mcp-rest/test/connection and /mcp-rest/test/tools/list, where a stdio server configuration (command, args, env) is spawned as a subprocess on the proxy host, yielding host takeover and theft of upstream API credentials; CybelAngel reports it chains with a Starlette host-header validation bypass (CVE-2026-48710) for unauthenticated RCE (CVSS 10.0), was added to CISA KEV on 2026-06-09, and names the Qilin ransomware group as exploiting it (single-source claim, not stated in the GTIG article). CVE-2026-5027 (Langflow <= 1.8.4) is a path traversal in the POST /api/v2/files upload handler where the unsanitized multipart 'filename' allows arbitrary file writes (cron jobs, SSH authorized_keys, webshells); with Langflow's default auto-login it needs no credentials. It was exploited in the wild from June 2026; roughly 7,000 instances are internet-exposed (Censys); fixed in 1.9.0 and later (1.10.0 current as of 2026-06-10). The older Langflow CVE-2025-3248 (unauthenticated Python code injection via /api/v1/validate/code exec()) was added to CISA KEV in May 2025.

GTIG counts 2,076 cumulative AI-stack vulnerabilities (1,500+ in 2026), with agent orchestration frameworks (Flowise, Langflow, LangChain, Dify and others) at 782 in 2026, about half of all AI-related flaws and a +347% increase. GTIG also cites the first known case of a threat actor holding a zero-day exploit script developed with generative AI, intercepted during operational planning (from GTIG's May AI Threat Tracker). No IOCs are in the GTIG article; the IOCs below come from Unit 42's BeyondTrust analysis. The article gives no CVSS scores; scores here come from vendor/third-party sources.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1059.006 Python
- T1505.003 Web Shell
- T1053.003 Cron
- T1098.004 SSH Authorized Keys
- T1078 Valid Accounts
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1572 Protocol Tunneling
- T1071.004 DNS
- T1219 Remote Access Tools
- T1496 Resource Hijacking
- T1587.004 Exploits

## Sources

- [Vulnerability Discovery and Exploitation Trends in the AI Era (GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era/)
- [Unit 42: VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)](https://unit42.paloaltonetworks.com/?p=173345)
- [Arctic Wolf: CVE-2026-1731 Unauthenticated OS Command Injection in BeyondTrust RS and PRA](https://arcticwolf.com/resources/blog-uk/cve-2026-1731-unauthenticated-os-command-injection-vulnerability-in-beyondtrust-remote-support-and-privileged-remote-access/)
- [BeyondTrust Security Advisory BT26-02](https://www.beyondtrust.com/trust-center/security-advisories/bt26-02)
- [Horizon3.ai: CVE-2026-1731](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-1731/)
- [CybelAngel: Top 7 Things to Know About the LiteLLM CVE-2026-42271 Exploit](https://cybelangel.com/blog/itellm-vulnerability-cve-2026-42271/)
- [Wiz Vulnerability Database: CVE-2026-42271](https://www.wiz.io/vulnerability-database/cve/cve-2026-42271)
- [BleepingComputer: Path traversal flaw in AI dev platform Langflow exploited in attacks](https://www.bleepingcomputer.com/news/security/path-traversal-flaw-in-ai-dev-platform-langflow-exploited-in-attacks/)
- [The Hacker News: Unpatched Langflow flaw CVE-2026-5027](https://thehackernews.com/2026/06/unpatched-langflow-flaw-cve-2026-5027.html)
- [Cloud Security Alliance: CVE-2026-5027 Langflow Path Traversal to Unauthenticated RCE](https://labs.cloudsecurityalliance.org/research/csa-research-note-langflow-cve-2026-5027-ai-platform-rce-202/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2818