The Shadowserver Foundation

If you receive an alert from us, please review the security advisory and guidance from Ivanti at hub.ivanti.com/s/article/Se... including the Exploitation Detection RPM Package co-developed by Ivanti & NCSC.nl

We have started to report webshells (or other artifacts) found on Ivanti EPMM devices, likely compromised via CVE-2026-1281. 56 IPs found on 2026-02-06

Data in shadowserver.org/what-we-do/n...

Tree Map view: dashboard.shadowserver.org/statistics/c...

Thank you to the KSA NCA for the heads up!

These reports help people defend the country against cyber attacks and also helps people fight scammer networks

#CyberCivilDefense #take9

See advisory and patch info from SolarWinds: www.solarwinds.com/trust-center...

If you receive an alert from us, make sure to review for compromise.

NVD entry: nvd.nist.gov/vuln/detail/...

Thank you to Validin for collaboration on the scan.

For the last few days, we have been sharing SolarWinds Help Desk CVE-2025-40551 RCE vulnerable IPs (version check based) - ~ 170 seen. This vuln is now on CISAKEV. Data in Vulnerable HTTP reports: www.shadowserver.org/what-we-do/n...

Dashboard Tree Map: dashboard.shadowserver.org/statistics/c...

See advisory and patch info from SolarWinds: www.solarwinds.com/trust-center...

If you receive an alert from us, make sure to review for compromise.

NVD entry: nvd.nist.gov/vuln/detail/...

Thank you to Validin for collaboration on the scan.

Dashboard Tree Map view: dashboard.shadowserver.org/statistics/i...

OpenClaw Dashboard exposure tracker (for past data, select vendor Moltbot on the Dashabord):
dashboard.shadowserver.org/statistics/i...

Hacking Moltbook: AI Social Network Reveals 1.5M API Keys | Wiz Blog Learn how a misconfigured Supabase database at Moltbook exposed 1.5M API keys, private messages, and user emails, enabling full AI agent takeover.

Most instances are across various cloud providers.

Our reporting is for awareness purposes.

OpenClaw has had various security risks highlighted recently (such as for example www.wiz.io/blog/exposed... & CVE-2026-25253 (1-Click RCE via Authentication Token Exfiltration)

We are scanning & reporting out exposed OpenClaw/Clawdbot/Moltbot instances, with ~25K seen 2026-02-02. We report these out in our Device Identification reporting, with vendor set to OpenClaw for all cases: www.shadowserver.org/what-we-do/n...

World Map: dashboard.shadowserver.org/statistics/i...

CVE-2026-1281 has been added to CISA Known Exploited Vulnerability catalog: www.cisa.gov/news-events/...

Additional background from watchTowr: labs.watchtowr.com/someone-know...

IP data on exposed instances shared in Device ID (device_vendor Ivanti, device_model EPMM ): www.shadowserver.org/what-we-do/n...

Dashboard World Map of exposed instances: dashboard.shadowserver.org/statistics/i...

Tree Map breakdown of exposed instances: dashboard.shadowserver.org/statistics/i...

Spike in Ivanti EPMM CVE-2026-1281 RCE exploitation attempts seen by our sensors last 24 hours from at least 13 source IPs. In our scans, we see ~1600 exposed instances worldwide (no vulnerability assessment). Top exposed: Germany (516)

Ivanti hotfix guidance: forums.ivanti.com/s/article/Se...

CISA Advisory: www.cisa.gov/news-events/...

Public Dashboard Tree Map view: dashboard.shadowserver.org/statistics/i...

Public Dashboard Exposure Tracker: dashboard.shadowserver.org/statistics/i...

#CyberCivilDefense

Numbers have gone down from 25 000+ seen when we first started reporting in mid-Dec 2025.

We share data on Fortinet devices with FortiCloud SSO enabled in our Device ID reporting: www.shadowserver.org/what-we-do/n...

Fortinet Advisory: www.fortiguard.com/psirt/FG-IR-...

CVE-2026-24858, a Fortinet authentication bypass vulnerability affecting multiple Fortinet products with FortiCloud SSO enabled, has been added by CISA to the KEV catalog.

We share exposed Fortinet instances with FortiCloud SSO enabled daily in our feeds (~10 000 seen)

Tracker: dashboard.shadowserver.org/statistics/c...

Please update to the latest build (9518 as of time of writing) www.smartertools.com/smartermail/...

Background: labs.watchtowr.com/attackers-wi...

#CyberCivilDefense

We added SmarterTools SmarterMail CVE-2026-23760 RCE to our daily Vulnerable HTTP scans. Around 6000 IPs globally found likely vulnerable based on our version check. We also see exploitation attempts in the wild.

CVE-2026-23760 Geo Treemap View: dashboard.shadowserver.org/statistics/c...

oss-sec: GNU InetUtils Security Advisory: remote authentication by-pass in telnetd

We have been tweaking the scan the last few days to better weed out non-telnet protocols. Some honeypots may remain.

Telnet should not be publicly exposed, but often is especially on legacy iot devices.

CVE-2026-24061 info & patch: seclists.org/oss-sec/2026...

Dashboard Tree Map view of telnet exposure (no vulnerability assessment): dashboard.shadowserver.org/statistics/c...

Like others, we also see exploitation attempts in the wild at scale.

#CyberCivilDefense

Regarding CVE-2026-24061 in GNU InetUtils telnetd: while we are not scanning for it explicitly (due to current lack of ability to check in a safe way, we do share - and have for years - data on exposed instances in our Accessible Telnet Report: www.shadowserver.org/what-we-do/n...

~800K exposed

SmarterTools Incorporated Our business email server, team chat, online help desk and web analytics software will help your business succeed. For business or personal users worldwide.

Update to latest SmarterMail version (Build 9413 and later): www.smartertools.com/smartermail/...

#CyberCivilDefense

NVD entry: nvd.nist.gov/vuln/detail/...

Singapore CSA advisory: www.csa.gov.sg/alerts-and-a...

CVE-2025-52691 Tracker: dashboard.shadowserver.org/statistics/c...

SmarterMail exposure tracker (not a vulnerability assessment):
dashboard.shadowserver.org/statistics/i...

We are scanning & reporting out SmarterMail hosts vulnerable to CVE-2025-52691 RCE (CVSS 10).
8001 unique IPs likely vulnerable on 2026-01-12 (18783 exposed). Note Exploit PoCs are public.

Tree Map: dashboard.shadowserver.org/statistics/c...

Raw IP data: www.shadowserver.org/what-we-do/n...

Iran Internet blackout visualized on our Public Dashboard - drop to near zero exposure after 2026-01-08 in scan and sinkhole telemetry:

Scan results: dashboard.shadowserver.org/statistics/c...

Sinkhole results:
dashboard.shadowserver.org/statistics/c...

IP data shared in Vulnerable HTTP reporting: shadowserver.org/what-we-do/n...

You can also track different scan results for recent n8n vulns (not just CVE-2026-21858 but also CVE-2025-68668, CVE-2025-68613, CVE-2026-21877) on Dashboard:

dashboard.shadowserver.org/statistics/c...

dashboard.shadowserver.org/statistics/c...

Note this is a version based scan. If you receive an alert from us make sure to update!

Vulnerability details: www.cyera.com/research-lab...

Thank you to Validin for the collaboration on the scan!

Dashboard World Map view:
dashboard.shadowserver.org/statistics/c...

CVE-2026-21858 Tracker:
dashboard.shadowserver.org/statistics/c...

Advisory with patch info: github.com/n8n-io/n8n/s...

NVD entry: nvd.nist.gov/vuln/detail/...

Scan results for n8n CVE-2026-21858 (CVSS 10.0 RCE) for 2026-01-09: 105,753 vulnerable instances by unique IP found - out of 230,562 IPs with n8n we see that day.

Dashboard Tree Map view: dashboard.shadowserver.org/statistics/c...

IP data in Vulnerable HTTP: www.shadowserver.org/what-we-do/n...

CVE-2020-12812 is also on CISA KEV.

Dashboard World Map view:
dashboard.shadowserver.org/statistics/c...

Dashboard Tree Map view:
dashboard.shadowserver.org/statistics/c...

Original Fortinet advisory from July 2020: www.fortiguard.com/psirt/FG-IR-...

#CyberCivilDefense