CVE-2019-9670: Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection
HoneyLabs honeypots recorded 20 probes matching CVE-2019-9670 from 2 distinct source IP addresses in the last 7 days. Severity is rated critical.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2022-01-10.
What the sensors show
Probes arrived on 4 of the 7 days in this window. The busiest day was 2026-10-28, with 9. One address, 46.151.178.14, sent 95% of them. The largest source network was AS211443 (Sino Worldwide Trading Limited), with 95% of the probes from 1 address. It is still being probed 4 years after CISA added it to the Known Exploited Vulnerabilities list. Over the last 90 days the sensors recorded 150 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i140900_cbb2034c60b8_e7c285222651.
Request paths that identify it
- /Autodiscover/Autodiscover.xml
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 46.151.178.14 | 19 | Sino Worldwide Trading Limited | The Netherlands |
| 66.92.21.200 | 1 | Psychz Networks | United States |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS211443 | Sino Worldwide Trading Limited | 19 | 1 |
| AS40676 | Psychz Networks | 1 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| The Netherlands | 19 |
| United States | 1 |
Captured requests
- /Autodiscover/Autodiscover.xml
- /autodiscover/autodiscover.xml
HTTP client fingerprints
- b11cun040_00040013_608dab68
- b11cuq050_00050812_107c8b82
CVE report
Open a specific CVE from the CVE tracker.