All news
exploitation

EdgeProtect

274 Zimbra Servers Compromised in the Wild via CVE-2026-73570

Unauthenticated command injection in Zimbra's SNMP notification handling is being exploited against internet-facing servers, with CISA setting a 3-day patch deadline.

24 September 2026
ZimbraCVE-2026-73570RCECISA KEVShadowserver
274 Zimbra Servers Compromised in the Wild via CVE-2026-73570

At a glance

1 CVE

Vulnerabilities

CVECVSSEPSSKEVPoCPRS risk
CVE-2026-735708.971.7%ExploitedAvailable81 · High

Technology affected

Synacor · Zimbra Collaboration Suite (ZCS)Zimbra · CollaborationMicrosoft · WindowsSynacor · Zimbra Collaboration SuiteZimbra · Zimbra Collaboration SuiteZimbra · Zimbra Collaboration Suite (ZCS)

Timeline

  1. Patch release

    Zimbra security team released version 10.1.20 to patch CVE-2026-73570.

  2. Active exploitation reported

    CERT Polska reported active exploitation of CVE-2026-73570

  3. Active exploitation report

    CERT Polska reported threat actors are now exploiting CVE-2026-73570 in attacks.

  4. Detection

    Shadowserver flagged 155 compromised instances

Vulnerability details

CVE CVSS KEV Fixed in
CVE-2026-73570 8.9 (NVD v3.1) ✅ added 21 August 2026, due 24 August ZCS 10.1.20

274 Zimbra servers already compromised in the wild

At least 274 internet-facing Zimbra Collaboration Suite (ZCS) instances have been compromised via CVE-2026-73570, the Shadowserver Foundation said on Monday 24 August 2026. Who is behind the attacks is not known.

CERT Polska reported active exploitation on 17 August and shared log entries and created files that point to compromise. Using those indicators, Shadowserver flagged 155 compromised instances on 20 August, and the number rose over the following days.

Shadowserver also counted at least 8,200 instances not yet updated to ZCS 10.1.20, though not all are open to attack, because the flaw is exploitable only in a non-default configuration.

The flaw: unauthenticated command injection via SNMP notification

CVE-2026-73570 is an OS command injection flaw in ZCS versions before 10.1.20. It affects servers that have the optional zimbra-snmp package installed and SNMP notifications enabled through the snmp_notify parameter.

"Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user," the CVE entry says. A crafted SMTP message reaches the vulnerable SNMP notification logic, giving the attacker command execution with the privileges of the Zimbra system account.

NVD rates the flaw 8.9 under CVSS v3.1. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 21 August 2026 and ordered US federal civilian agencies to address it by 24 August and check for evidence of compromise.

Timeline: disclosed 26 June, patched 20 July, exploited from 17 August

  • 26 June 2026: the vulnerability was first disclosed, with a temporary mitigation for administrators until a fix was available.
  • 20 July 2026: Synacor released ZCS 10.1.20, which fixes the flaw.
  • 17 August 2026: CERT Polska reported in-the-wild exploitation.
  • 20 August 2026: Shadowserver flagged 155 compromised instances.
  • 21 August 2026: CISA added CVE-2026-73570 to KEV, with a 24 August deadline.
  • 24 August 2026: Shadowserver reported at least 274 compromised instances.

What Zimbra admins should do

Upgrade to ZCS 10.1.20 or later. CERT Polska advises checking logs for suspicious activity, such as the Zimbra service restarting on its own, and looking for files created by the zimbra user in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/ and /tmp/ over the last 30 days.

Zimbra flaws have been exploited by both state-sponsored groups and opportunistic criminals in the past.

Key points

  • CVE-2026-73570 is an unauthenticated OS command injection (CVSS 8.9, NVD v3.1) in Zimbra Collaboration Suite before 10.1.20, exploitable only when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
  • Shadowserver reported at least 274 compromised internet-facing Zimbra servers on 24 August 2026; CERT Polska reported exploitation on 17 August.
  • CISA added the CVE to KEV on 21 August 2026 with a 24 August deadline for US federal civilian agencies.
  • Successful exploitation runs arbitrary OS commands as the zimbra user via crafted SMTP requests.
  • Synacor fixed the bug in ZCS 10.1.20, released on 20 July 2026; at least 8,200 instances had not been updated, though not all are exploitable.

Further reading & sources