swatchrc[.]inDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 2 days ago
What the reports say
1 report, newest first · the exact sentence from each-
How CVE-2026-73570 turns a Zimbra log file into remote code execution“It tails the log file and compiles /opt/zimbra/conf/swatchrc[.]in into a Perl script using perlcode lines to directly embed Perl commands into that script.”
Indicators reported together
named in the same reports- hxxp://10.0.2[.]16:8080/capture/abc123/in 1 report
- hxxp://10.0.2[.]16:8080/capture/abc123/$in 1 report
- hxxp://10.0.2[.]16:8080/capture/in 1 report
Copy these 3 indicators · defanged
Also named with it: CVE-2026-73570
Thanks — we review every report.