We have also added CVE-2026-2699 tagging to our scans, which now detect unpatched Progress ShareFile instances. 120 seen 2026-04-06 dashboard.shadowserver.org/statistics/c... Tree Map view: dashboard.shadowserver.org/statistics/c... IP data in Vulnerable HTTP: www.shadowserver.org/what-we-do/n...

Heads up FortiClient EMS users! CVE-2026-35616 (new) & CVE-2026-21643 - both unauthenticated RCE observed to be exploited in the wild! We fingerprint about 2000 instances globally, see public Dashboard: dashboard.shadowserver.org/statistics/i... Top affected: US & Germany

We added Progress ShareFile fingerprinting to our scans & reports with 784 unique IPs seen exposed on 2026-04-02. watchTowr recently disclosed details behind an RCE CVE-2026-2699 & CVE-2026-2701 exploit chain affecting ShareFile. Make sure to apply the latest patch!

F5 BIG-IP APM CVE-2025-53521 impact has recently been updated from a DoS to RCE (see: my.f5.com/manage/s/art...) & added to CISA KEV. We are fingerprinting & sharing F5 BIG-IP APM instances - over 17.1K IPs seen on 2026-03-31 globally. This is just a population assessment.

We’re excited to welcome KPN to the Shadowserver Alliance as a bronze tier partner! KPN is a leading telecommunications and IT provider in the Netherlands. www.kpn.com/algemeen/eng... Together we will raise the bar on cybersecurity to make the Internet more secure.

IIS EOL tracker: dashboard.shadowserver.org/statistics/c...

Over 511 000 End-of-Life Microsoft IIS instances seen in our daily scans, out of those over 227 000 instances that are beyond the official Microsoft Extended Security Updates (ESU) period. We now tag those 'eol-iis' and 'eos-iis' respectively in our Vulnerable HTTP reports.

We added Microsoft SharePoint CVE-2026-20963 (post-auth deserialization RCE) to our scanning & daily feeds. 1109 IPs found running vulnerable instances worldwide (close to 1900 FQDNs) on 2026-03-19, with 510 IPs in the US. Dashboard World Map: dashboard.shadowserver.org/statistics/c...

We added a feed of IPs/websites with ClickFix/ClearFake injected code in our Compromised Website reporting, tagged as 'clickfix'. Visitors of the website get tricked to install malware when injected JavaScript executes. If you receive an alert review for root cause of compromise!

Great to support our international LE and private sector partners in Tycoon 2FA phishing-as-a-service #cybercrime disruption: shadowserver.org/news/tycoon-... New nCSIRT-only Tycoon 2FA Domains Special Report run 2026-03-04 (historical C2/panel/infra domains) www.shadowserver.org/what-we-do/n...

Another Iran Internet blackout, this time due to the war, visualized on our Public Dashboard - drop to near zero on 2026-03-01: dashboard.shadowserver.org/statistics/c...

We are continuing to expand our n8n RCE vulnerability scanning - most recently adding CVE-2026-27495 (CVSS 9.4) tagging as well. You can track our various n8n scan results here for the most well known critical vulns: dashboard.shadowserver.org/statistics/c... Top affected: US, Germany & France.

We are scanning & reporting IceWarp CVE-2025-14500 (CVSS 9.8, pre-auth command injection RCE) instances. 1278 IPs seen 2026-03-01 (version based). Patch: support.icewarp.com/hc/en-us/com... IP data: www.shadowserver.org/what-we-do/n... World Map view: dashboard.shadowserver.org/statistics/c...

Cisco SD-WAN incidents: we are sharing data on identified Cisco SD-WAN IPs Device ID reporting - www.shadowserver.org/what-we-do/n... ~5.5K Cisco SD-WAN IPs (control plane) (dashboard.shadowserver.org/statistics/i...) & over 270 management interfaces (dashboard.shadowserver.org/statistics/i...)

Thanks to collaboration with the Canadian Centre for Cyber Security we can share more comprehensive information on FreePBX instances running webshells, with still over 900 IPs seen compromised. Dashboard Victim overview (Tree map) dashboard.shadowserver.org/statistics/c...

Massive increase in sources attempting Ivanti EPMM CVE-2026-1281 exploitation, with over 28.3K source IPs seen on 2026-02-09. IP data on attackers shared in our www.shadowserver.org/what-we-do/n... (with vulnerability_id set to CVE-2026-1281). 20.4K IPs seen from US networks.

Running End-of-Life devices or apps is a major security risk. @CISACyber has recently released a Directive on the topic: www.cisa.gov/news-events/... It's worth mentioning we share many End-of-Life devices/apps in our daily reporting, tagged 'eol'. See: dashboard.shadowserver.org/statistics/c...

We have started to report webshells (or other artifacts) found on Ivanti EPMM devices, likely compromised via CVE-2026-1281. 56 IPs found on 2026-02-06 Data in shadowserver.org/what-we-do/n... Tree Map view: dashboard.shadowserver.org/statistics/c... Thank you to the KSA NCA for the heads up!

These reports help people defend the country against cyber attacks and also helps people fight scammer networks #CyberCivilDefense #take9

For the last few days, we have been sharing SolarWinds Help Desk CVE-2025-40551 RCE vulnerable IPs (version check based) - ~ 170 seen. This vuln is now on CISAKEV. Data in Vulnerable HTTP reports: www.shadowserver.org/what-we-do/n... Dashboard Tree Map: dashboard.shadowserver.org/statistics/c...

We are scanning & reporting out exposed OpenClaw/Clawdbot/Moltbot instances, with ~25K seen 2026-02-02. We report these out in our Device Identification reporting, with vendor set to OpenClaw for all cases: www.shadowserver.org/what-we-do/n... World Map: dashboard.shadowserver.org/statistics/i...

Spike in Ivanti EPMM CVE-2026-1281 RCE exploitation attempts seen by our sensors last 24 hours from at least 13 source IPs. In our scans, we see ~1600 exposed instances worldwide (no vulnerability assessment). Top exposed: Germany (516) Ivanti hotfix guidance: forums.ivanti.com/s/article/Se...

CVE-2026-24858, a Fortinet authentication bypass vulnerability affecting multiple Fortinet products with FortiCloud SSO enabled, has been added by CISA to the KEV catalog. We share exposed Fortinet instances with FortiCloud SSO enabled daily in our feeds (~10 000 seen)

We added SmarterTools SmarterMail CVE-2026-23760 RCE to our daily Vulnerable HTTP scans. Around 6000 IPs globally found likely vulnerable based on our version check. We also see exploitation attempts in the wild. CVE-2026-23760 Geo Treemap View: dashboard.shadowserver.org/statistics/c...

Regarding CVE-2026-24061 in GNU InetUtils telnetd: while we are not scanning for it explicitly (due to current lack of ability to check in a safe way, we do share - and have for years - data on exposed instances in our Accessible Telnet Report: www.shadowserver.org/what-we-do/n... ~800K exposed

We are scanning & reporting out SmarterMail hosts vulnerable to CVE-2025-52691 RCE (CVSS 10). 8001 unique IPs likely vulnerable on 2026-01-12 (18783 exposed). Note Exploit PoCs are public. Tree Map: dashboard.shadowserver.org/statistics/c... Raw IP data: www.shadowserver.org/what-we-do/n...

Iran Internet blackout visualized on our Public Dashboard - drop to near zero exposure after 2026-01-08 in scan and sinkhole telemetry: Scan results: dashboard.shadowserver.org/statistics/c... Sinkhole results: dashboard.shadowserver.org/statistics/c...

You can also track different scan results for recent n8n vulns (not just CVE-2026-21858 but also CVE-2025-68668, CVE-2025-68613, CVE-2026-21877) on Dashboard: dashboard.shadowserver.org/statistics/c... dashboard.shadowserver.org/statistics/c...

Scan results for n8n CVE-2026-21858 (CVSS 10.0 RCE) for 2026-01-09: 105,753 vulnerable instances by unique IP found - out of 230,562 IPs with n8n we see that day. Dashboard Tree Map view: dashboard.shadowserver.org/statistics/c... IP data in Vulnerable HTTP: www.shadowserver.org/what-we-do/n...

We added Fortinet SSL-VPN CVE-2020-12812 to our daily Vulnerable HTTP Report: www.shadowserver.org/what-we-do/n... After 5 1/2 years since being published still over 10K Fortinet firewalls remain unpatched. Actively exploited as recently highlighted by Fortinet: www.fortinet.com/blog/psirt-b...

MongoBleed update: We added MongoDB CVE-2025-14847 tagging today that is version based. This results in 74,854 possibly unpatched versions (out of 78,725 exposed today). IP data on vulnerable instances shared in our Open MongoDB Report: www.shadowserver.org/what-we-do/n...

Great to again provide technical support to Interpol & international LE partners, this time on Operation Sentinel: interpol.int/en/News-and-... Undertaken as part of African Joint Operation against Cybercrime (AFJOC) project, funded by UK FCDO, & EU/Council of Europe GLACY-e project

Attention! We are scanning & reporting WatchGuard Firebox devices unpatched to CVE-2025-14733 (Out of Bounds Write Vulnerability, unauthenticated RCE, CVSS 9.8). Nearly 125 000 IPs found (2025-12-20): dashboard.shadowserver.org/statistics/c... WatchGuard Advisory: www.watchguard.com/wgrd-psirt/a...

We have identified 120 Cisco Secure Email Gateway/ Cisco Secure Email and Web Manager likely vulnerable to CVE-2025-20393 (over 650 fingerprinted exposed). CVE-2025-20393 is exploited in the wild, with no patch available. Follow Cisco recommendations at sec.cloudapps.cisco.com/security/cen...

We added fingerprinting of Fortinet devices with FortiCloud SSO enabled to our Device Identification reporting (at least 25K IPs seen globally). While not necessarily vulnerable to CVE-2025-59718/CVE-2025-59719 if you get a report from us regarding exposure, please verify/patch!

Second Rhadamanthys Historic Bot Victims Special Report run overnight (dated 2025-12-15): 92M stolen data items from 567K victim IPs across 228 countries Additional data shared by LE partners under Operation Endgame Updated blog: shadowserver.org/news/rhadama... Check your reports!

Using ELK & interested in automating ingestion of our threat intel for your network/constituency via our API? We have introduced an ECS logging script for our intelligence reports. This script uses Redis to queue events for Logstash. Check it out at github.com/The-Shadowse...

Update on React Server Components CVE-2025-55182: over 165K IPs & 644K domains with vulnerable code found on 2025-12-08 after scan targeting improvements! See: dashboard.shadowserver.org/statistics/c... Check for compromise & patch! Thank you to Validin & LeakIX for the collaboration!

Like others we are seeing attacks attempting to exploit React CVE-2025-55182 at scale, incl. botnet related activity. How successful have these attacks been? You can get a view here, where we track compromised host with Next.js attacking our sensors: dashboard.shadowserver.org/statistics/h...

React Server Components (CVE-2025-55182) RCE findings so far on 2025-12-05. 77664 IPs found vulnerable (based on Assetnote methodology). IP data is being shared in Vulnerable HTTP reports: www.shadowserver.org/what-we-do/n... Dashboard geo breakdown: dashboard.shadowserver.org/statistics/c...

React Server Components (CVE-2025-55182) RCE findings so far on 2025-12-05. 77664 IPs found vulnerable (based on Assetnote methodology). IP data is being shared in Vulnerable HTTP reports: www.shadowserver.org/what-we-do/n... Dashboard geo breakdown: dashboard.shadowserver.org/statistics/c...

Excited that our collaboration with VulnCheck (vulncheck.com) continues to grow as we welcome them as a new Shadowserver Alliance Partner -Silver tier! We look forward to enhancing our joint efforts to help network defenders globally with vulnerability management.

We shared out 10,449 entries (e-mails) affected by the JSONFormatter and CodeBeautifier leak discovered by @watchTowr (see labs.watchtowr.com/stop-putting...). Data shared in a our Compromised Account Report www.shadowserver.org/what-we-do/n... (search for 2025-11-26 & compromised_account prefix)

Operation Endgame Season 3 Episode 2: Interlude released in time for Thanksgiving, recapping some of the #cybercrime disruption successes achieved so far, by partners working together internationally. Happy holidays - looking forward to future episodes!

We have been sharing Monsta FTP CVE-2025-34299 (pre-auth RCE) vulnerable instances for the last few weeks. We still see over 780 IPs vulnerable (version based check) instances daily. Most affected: US & Slovakia: dashboard.shadowserver.org/statistics/c... dashboard.shadowserver.org/statistics/c...

Proud to once again support our LE partners in Operation Endgame Season 3 86M stolen data items from 525K victim IPs across 226 countries included in our new Rhadamanthys Historic Bot Victims Special Report, run overnight 2025-11-12 More details: shadowserver.org/news/rhadama...

"Don’t take BADCANDY from strangers ..." The Australian Signals Directorate (ASD) recently published an advisory on the BadCandy implant still present in many Cisco IOS XE devices: www.cyber.gov.au/about-us/vie... We still see around 15 000 Cisco IOS XE devices with the implant

We added CVE-2025-40778 BIND9 tagging (potential susceptibility to cache poisoning) to our DNS scans: www.shadowserver.org/what-we-do/n... We found nearly 8898 unpatched DNS open resolvers on 2025-10-30, down to 6653 on 2025-11-01: dashboard.shadowserver.org/statistics/c...

Attention - Microsoft WSUS CVE-2025-59287 incidents! We are observing exploitation attempts based on a published POC. We have also began fingerprinting exposed WSUS instances (ports 8530/8531) with at least 2800 seen on 2025-10-25 (not necessarily vulnerable).

We are now sharing daily IP data on WatchGuard Fireware OS IKEv2 Out-of-Bounds Write CVE-2025-9242 vulnerable instances, with over 71 000 seen on 2025-10-18. Data shared in our Vulnerable ISAKMP reportings - www.shadowserver.org/what-we-do/n... Top affected: US with 23.2K instances