hxxp://10.0.2[.]16:8080/capture/URL

Reported by 1 independent source · first reported 23 Oct 2026 by Elastic Security Labs · last reported 23 Oct 2026

Last reported 2 days ago

What the reports say

1 report, newest first · the exact sentence from each

“[*] Internal OOB listener started on hxxp://10.0.2[.]16:8080/capture/...”

Elastic Security LabsVendor23 Oct 2026
How CVE-2026-73570 turns a Zimbra log file into remote code execution

named in the same reports

Copy these 3 indicators · defanged

3 indicators, defanged, one per line

swatchrc[.]in
hxxp://10.0.2[.]16:8080/capture/abc123/
hxxp://10.0.2[.]16:8080/capture/abc123/$

Also named with it: CVE-2026-73570

Thanks — we review every report.

Report a wrong value