#CyberCivilDefense

CISA KEV entry: www.cisa.gov/known-exploi...

NVD CVE entry: nvd.nist.gov/vuln/detail/...

IP data shared in our Accessible ActiveMQ reporting www.shadowserver.org/what-we-do/n...

For Dashboard viewing, select sources 'activemq' and 'cve-2026-34197'

ActiveMQ Security advisory: activemq.apache.org/security-adv...

Background with details from Horizon3.ai horizon3.ai/attack-resea...

We are now scanning daily for CVE-2026-34197 (Apache ActiveMQ Improper Input Validation Vulnerability) which has recently been added to US CISA KEV.

6364 IPs seen vulnerable on 2026-04-19 based on a version check.

Dashboard Tree Map view:
dashboard.shadowserver.org/statistics/c...

We added CVE-2026-35616 scans based on the vulnerability detector developed by Bishop Fox
bishopfox.com/blog/api-aut....

Over 60 IPs still assessed as vulnerable: dashboard.shadowserver.org/statistics/c...

Data shared daily in our Vulnerable HTTP reporting: shadowserver.org/what-we-do/n...

Become an Alliance Partner today: www.shadowserver.org/partner/

We’re excited to announce that the Canadian Centre for Cyber Security (CCCS) has increased its annual Shadowserver Alliance Partnership tier from Gold to Diamond! Thank you CCCS for your generous support and for being a valuable and trusted partner in making the Internet more secure.

Become an Alliance Partner today: www.shadowserver.org/partner/

We have also added CVE-2026-2699 tagging to our scans, which now detect unpatched Progress ShareFile instances. 120 seen 2026-04-06
dashboard.shadowserver.org/statistics/c...

Tree Map view: dashboard.shadowserver.org/statistics/c...

IP data in Vulnerable HTTP: www.shadowserver.org/what-we-do/n...

Patch info:
CVE-2026-35616 (0day reported by Defused Cyber): fortiguard.fortinet.com/psirt/FG-IR-...
CVE-2026-21643: fortiguard.fortinet.com/psirt/FG-IR-...

World Map view: dashboard.shadowserver.org/statistics/i...

Raw IP data shared in our Device ID reporting www.shadowserver.org/what-we-do/n...
If you receive data from us on exposed instances, check for compromise & patch!

Heads up FortiClient EMS users! CVE-2026-35616 (new) & CVE-2026-21643 - both unauthenticated RCE observed to be exploited in the wild! We fingerprint about 2000 instances globally, see public Dashboard: dashboard.shadowserver.org/statistics/i...

Top affected: US & Germany

CVE-2026-2699 NVD entry: nvd.nist.gov/vuln/detail/...

CVE-2026-2701 NVD entry:
nvd.nist.gov/vuln/detail/...

#CyberCivilDefense

Thank you to Validin for the collaboration!

Top affected: US, Germany

Note: we are just sharing the exposed population, there is no vulnerability assessment

Patch: docs.sharefile.com/en-us/storag...

Background: labs.watchtowr.com/youre-not-su...

Raw IP data in Device ID reports, with device_vendor set to Progress & device_model to ShareFile: www.shadowserver.org/what-we-do/n...

Dashboard World Map view: dashboard.shadowserver.org/statistics/i...

Dashboard Tree Map view:
dashboard.shadowserver.org/statistics/i...

We added Progress ShareFile fingerprinting to our scans & reports with 784 unique IPs seen exposed on 2026-04-02.

watchTowr recently disclosed details behind an RCE CVE-2026-2699 & CVE-2026-2701 exploit chain affecting ShareFile. Make sure to apply the latest patch!

#CyberCivilDefense

Top affected: US, Japan

If you have APM running on your services/network make sure you are patched & review for any compromise

NVD entry: nvd.nist.gov/vuln/detail/...

IP data is shared in our Device ID reporting www.shadowserver.org/what-we-do/n... with device_vendor set to 'F5', device_model set to 'BIG-IP APM'

Dashboard Tree Map view: dashboard.shadowserver.org/statistics/i...

Dashboard World Map view:
dashboard.shadowserver.org/statistics/i...

F5 BIG-IP APM CVE-2025-53521 impact has recently been updated from a DoS to RCE (see: my.f5.com/manage/s/art...) & added to CISA KEV.

We are fingerprinting & sharing F5 BIG-IP APM instances - over 17.1K IPs seen on 2026-03-31 globally. This is just a population assessment.

Become a Shadowserver Alliance partner today: www.shadowserver.org/partner/

We’re excited to welcome KPN to the Shadowserver Alliance as a bronze tier partner!

KPN is a leading telecommunications and IT provider in the Netherlands. www.kpn.com/algemeen/eng...

Together we will raise the bar on cybersecurity to make the Internet more secure.

IIS EOL tracker: dashboard.shadowserver.org/statistics/c...

More on associated risks & on reducing attack surface from EOL devices from US CISA www.cisa.gov/resources-to...

MS IIS lifecycle: learn.microsoft.com/en-us/lifecy...

MS Extended Security Update program (ESU) learn.microsoft.com/en-us/lifecy...

#CyberCivilDefense

Raw IP data shared in www.shadowserver.org/what-we-do/n... filtered by recipient network/constituency

Top affected: China & USA

EOL IIS Dashboard World Map view: dashboard.shadowserver.org/statistics/c...

EOS (beyond ESU) IIS Dashboard World Map view: dashboard.shadowserver.org/statistics/c...

Over 511 000 End-of-Life Microsoft IIS instances seen in our daily scans, out of those over 227 000 instances that are beyond the official Microsoft Extended Security Updates (ESU) period. We now tag those 'eol-iis' and 'eos-iis' respectively in our Vulnerable HTTP reports.

CVE-2026-20963 Dashboard Tracker: dashboard.shadowserver.org/statistics/c...

Dashboard Tree Map view: dashboard.shadowserver.org/statistics/c...

#CyberCivilDefense

Vulnerable IPs (tagged 'cve-2026-20963') shared daily in our Vulnerable HTTP reporting: www.shadowserver.org/what-we-do/n...

CVE-2026-20963 is known exploited in the wild and on CISA KEV: www.cisa.gov/known-exploi...

Check for compromise.

Microsoft Advisory: msrc.microsoft.com/update-guide...

We added Microsoft SharePoint CVE-2026-20963 (post-auth deserialization RCE) to our scanning & daily feeds. 1109 IPs found running vulnerable instances worldwide (close to 1900 FQDNs) on 2026-03-19, with 510 IPs in the US.

Dashboard World Map: dashboard.shadowserver.org/statistics/c...

Compromised Website Report: www.shadowserver.org/what-we-do/n...

Dashboard World Map view of infected IPs:
dashboard.shadowserver.org/statistics/c...

Dashboard Tree Map view of infected IPs:
dashboard.shadowserver.org/statistics/c...

#CyberCivilDefense