{"vulnerability": "CVE-2026-0866", "sightings": [{"uuid": "feec9aa8-28f7-453f-b478-e11d30d20898", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/116209861321874609", "content": "", "creation_timestamp": "2026-03-11T09:36:01.541599Z"}, {"uuid": "7e2a25aa-8785-4f85-a2c6-4f51488ffe62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mgtxe5kdhs23", "content": "", "creation_timestamp": "2026-03-12T08:13:36.145843Z"}, {"uuid": "858ec70c-6242-4ac3-ac94-bb2376c5b5c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://bsky.app/profile/decalage.bsky.social/post/3mgvfueazrc2n", "content": "", "creation_timestamp": "2026-03-12T22:05:52.584494Z"}, {"uuid": "83e30ab8-e736-4075-8e16-139e3f3e0a8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://infosec.exchange/users/threatcodex/statuses/116212166122511000", "content": "", "creation_timestamp": "2026-03-11T19:22:12.176832Z"}, {"uuid": "5b527c62-c354-46a7-af88-3dd283f63efd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mgvujrkwsw2j", "content": "", "creation_timestamp": "2026-03-13T02:28:23.338788Z"}, {"uuid": "a80857fc-ceb2-4adf-a661-090d6d3692e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mguechicgc2k", "content": "", "creation_timestamp": "2026-03-12T12:05:19.033795Z"}, {"uuid": "494a35ef-9b98-4e01-9a9c-41b63a5e2cd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://isc.sans.edu/diary/32786?n", "content": "", "creation_timestamp": "2026-03-12T03:00:13.000000Z"}, {"uuid": "cedefce4-5a02-47f7-a7ee-b06e6b335322", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-0866", "content": "", "creation_timestamp": "2026-03-18T19:16:19.000000Z"}, {"uuid": "8de6d2f5-5f09-483c-bedc-dc457bb9471d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/76565", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a zombieguard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mdshoaibuddinchanda\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 3  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-03-22 10:47:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nML-based detection of Zombie ZIP archive header evasion attacks (CVE-2026-0866)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-03-22T11:00:04.000000Z"}, {"uuid": "96784206-4ce0-4e8b-886e-f9411f1de8e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/8623", "content": "\u26a0\ufe0f CERT/CC warns a ZIP flaw tracked as CVE-2026-0866 lets attackers hide malware using malformed archive headers.\n\nSecurity tools trust the header and miss the payload, while it can still be extracted and executed with the right method.\n\nIt breaks how AV and EDR validate files.\n\n\ud83d\udd17 How Zombie ZIP bypasses detection and runs payloads \u2192 https://thehackernews.com/2026/03/threatsday-bulletin-oauth-trap-edr.html#zip-evasion-technique", "creation_timestamp": "2026-03-18T13:46:08.000000Z"}, {"uuid": "0d0473d2-47a6-4c84-a347-36d76a30b404", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3013", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c ClamAV \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043d\u0444\u043b\u0438\u043a\u0442\u0430 \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0446\u0438\u0439 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b zip-\u0430\u0440\u0445\u0438\u0432\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043e\u0431\u0445\u043e\u0434 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e zip-\u0430\u0440\u0445\u0438\u0432\u0430\n\nBDU:2026-03110\nCVE-2026-0866\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0437\u0430\u043c\u043a\u043d\u0443\u0442\u043e\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u044b \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0438\u0437 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e;\n- \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 SIEM-\u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438; \n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 (\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442).\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438:\nhttps://github.com/Bombadil-Systems/zombie-zip/blob/main/README.md\nhttps://kb.cert.org/vuls/id/976247", "creation_timestamp": "2026-03-16T14:55:33.000000Z"}, {"uuid": "d41203d1-e4f7-4134-9092-ec3d74fb01e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://t.me/ctinow/246968", "content": "Analyzing \"Zombie Zip\" Files (CVE-2026-0866), (Wed, Mar 11th)\nhttps://ift.tt/BGyQYu8", "creation_timestamp": "2026-03-11T10:09:25.000000Z"}, {"uuid": "5dd8fd02-44a1-45e1-85bb-a662875db316", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://t.me/CyberDispatch/997", "content": "CERT/CC warns a ZIP flaw tracked as CVE-2026-0866 lets attackers hide malware using malformed archive headers.\n\nSecurity tools trust the header and miss the payload, while it can still be extracted and executed with the right method.\n\nIt breaks how AV and EDR validate files.", "creation_timestamp": "2026-08-30T00:00:44.305315Z"}, {"uuid": "deaa2006-4287-46b6-8dea-90d0616c12b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://t.me/CyberDispatch/979", "content": "CERT/CC warns a ZIP flaw tracked as CVE-2026-0866 lets attackers hide malware using malformed archive headers.\n\nSecurity tools trust the header and miss the payload, while it can still be extracted and executed with the right method.", "creation_timestamp": "2026-08-30T00:00:44.455132Z"}, {"uuid": "57b24a93-8750-4f05-8891-09da4e3c8185", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://t.me/CyberDispatch/997", "content": "CERT/CC warns a ZIP flaw tracked as CVE-2026-0866 lets attackers hide malware using malformed archive headers.\n\nSecurity tools trust the header and miss the payload, while it can still be extracted and executed with the right method.\n\nIt breaks how AV and EDR validate files.", "creation_timestamp": "2026-08-29T20:00:18.507166Z"}, {"uuid": "e6515dbb-958e-46b7-ac4e-be3557ba1d7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://t.me/CyberDispatch/979", "content": "CERT/CC warns a ZIP flaw tracked as CVE-2026-0866 lets attackers hide malware using malformed archive headers.\n\nSecurity tools trust the header and miss the payload, while it can still be extracted and executed with the right method.", "creation_timestamp": "2026-08-29T20:00:18.678449Z"}, {"uuid": "feb9979f-7854-4fca-8a89-5e1828bf34df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://t.me/CyberDispatch/997", "content": "CERT/CC warns a ZIP flaw tracked as CVE-2026-0866 lets attackers hide malware using malformed archive headers.\n\nSecurity tools trust the header and miss the payload, while it can still be extracted and executed with the right method.\n\nIt breaks how AV and EDR validate files.", "creation_timestamp": "2026-08-31T00:00:25.841688Z"}, {"uuid": "c53ba2c7-11ec-4278-94e3-b402b0e1c6bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0866", "type": "seen", "source": "https://t.me/CyberDispatch/979", "content": "CERT/CC warns a ZIP flaw tracked as CVE-2026-0866 lets attackers hide malware using malformed archive headers.\n\nSecurity tools trust the header and miss the payload, while it can still be extracted and executed with the right method.", "creation_timestamp": "2026-08-31T00:00:25.605657Z"}]}