[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7VKEmfV8pvsyySyMAzXXozo8w52hBD7dJb9UQALBumc":3,"$fLnkS3j_tCuFSGoQY1ecQ6O4hrKZLZrm_Lbi9C4veEY8":60},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":56,"created_at":57,"updated_at":58,"published_at":59},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Unauthenticated command injection in Zimbra's SNMP notification handling is being exploited against internet-facing servers, with CISA setting a 3-day patch deadline.","Shadowserver found at least 274 internet-facing Zimbra Collaboration Suite servers compromised via CVE-2026-73570, an unauthenticated OS command injection that affects servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and lets attackers run commands as the zimbra user via crafted SMTP requests.",[10,11,12,13,14],"Zimbra","CVE-2026-73570","RCE","CISA KEV","Shadowserver","# 274 Zimbra Servers Compromised in the Wild via CVE-2026-73570\n\n*Unauthenticated command injection in Zimbra's SNMP notification handling is being exploited against internet-facing servers, with CISA setting a 3-day patch deadline.*\n\n**Tags:** `Zimbra` `CVE-2026-73570` `RCE` `CISA KEV` `Shadowserver`\n\n> Shadowserver found at least 274 internet-facing Zimbra Collaboration Suite servers compromised via CVE-2026-73570, an unauthenticated OS command injection that affects servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and lets attackers run commands as the zimbra user via crafted SMTP requests.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | KEV | Fixed in |\n|---|---|---|---|\n| CVE-2026-73570 | 8.9 (NVD v3.1) | ✅ added 21 August 2026, due 24 August | ZCS 10.1.20 |\n\n## 274 Zimbra servers already compromised in the wild\n\nAt least 274 internet-facing Zimbra Collaboration Suite (ZCS) instances have been compromised via CVE-2026-73570, the Shadowserver Foundation said on Monday 24 August 2026. Who is behind the attacks is not known.\n\nCERT Polska reported active exploitation on 17 August and shared log entries and created files that point to compromise. Using those indicators, Shadowserver flagged 155 compromised instances on 20 August, and the number rose over the following days.\n\nShadowserver also counted at least 8,200 instances not yet updated to ZCS 10.1.20, though not all are open to attack, because the flaw is exploitable only in a non-default configuration.\n\n## The flaw: unauthenticated command injection via SNMP notification\n\nCVE-2026-73570 is an OS command injection flaw in ZCS versions before 10.1.20. It affects servers that have the optional `zimbra-snmp` package installed and SNMP notifications enabled through the `snmp_notify` parameter.\n\n\"Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user,\" the CVE entry says. A crafted SMTP message reaches the vulnerable SNMP notification logic, giving the attacker command execution with the privileges of the Zimbra system account.\n\nNVD rates the flaw 8.9 under CVSS v3.1. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 21 August 2026 and ordered US federal civilian agencies to address it by 24 August and check for evidence of compromise.\n\n## Timeline: disclosed 26 June, patched 20 July, exploited from 17 August\n\n- **26 June 2026:** the vulnerability was first disclosed, with a temporary mitigation for administrators until a fix was available.\n- **20 July 2026:** Synacor released ZCS 10.1.20, which fixes the flaw.\n- **17 August 2026:** CERT Polska reported in-the-wild exploitation.\n- **20 August 2026:** Shadowserver flagged 155 compromised instances.\n- **21 August 2026:** CISA added CVE-2026-73570 to KEV, with a 24 August deadline.\n- **24 August 2026:** Shadowserver reported at least 274 compromised instances.\n\n## What Zimbra admins should do\n\nUpgrade to ZCS 10.1.20 or later. CERT Polska advises checking logs for suspicious activity, such as the Zimbra service restarting on its own, and looking for files created by the `zimbra` user in `\u002Fopt\u002Fzimbra\u002Fjetty\u002Fwebapps\u002F`, `\u002Fopt\u002Fzimbra\u002Fjetty_base\u002Fwebapps\u002F` and `\u002Ftmp\u002F` over the last 30 days.\n\nZimbra flaws have been exploited by both state-sponsored groups and opportunistic criminals in the past.\n\n## Key points\n\n- CVE-2026-73570 is an unauthenticated OS command injection (CVSS 8.9, NVD v3.1) in Zimbra Collaboration Suite before 10.1.20, exploitable only when the optional zimbra-snmp package is installed and SNMP notifications are enabled.\n- Shadowserver reported at least 274 compromised internet-facing Zimbra servers on 24 August 2026; CERT Polska reported exploitation on 17 August.\n- CISA added the CVE to KEV on 21 August 2026 with a 24 August deadline for US federal civilian agencies.\n- Successful exploitation runs arbitrary OS commands as the `zimbra` user via crafted SMTP requests.\n- Synacor fixed the bug in ZCS 10.1.20, released on 20 July 2026; at least 8,200 instances had not been updated, though not all are exploitable.\n\n## Further reading & sources\n\n- [Unpatched Zimbra servers are falling to CVE-2026-73570 attacks](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F08\u002F25\u002Fzimbra-cve-2026-73570-compromised) (Help Net Security)\n- [Zimbra vulnerability CVE-2026-73570: find impacted assets](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fzimbra) (runZero)\n- [Critical Zimbra RCE flaw now actively exploited in attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcritical-zimbra-rce-flaw-now-actively-exploited-in-attacks\u002F) (BleepingComputer)\n- [Microsoft patches 398 flaws; Zimbra exploitation deadline…](https:\u002F\u002Fdefend.network\u002Fbriefings\u002Fmicrosoft-patch-tuesday-zimbra-exploitation-android-veh-2026-08-24.html) (defend.network Daily Briefings)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2",{"cves":18,"timeline":27,"technologies":43},[19],{"id":11,"kev":20,"poc":20,"url":21,"cvss":22,"epss":23,"risk_band":24,"risk_score":25,"cvss_version":26},true,"\u002Fvulnerabilities\u002FCVE-2026-73570",8.9,0.7166,"High",81.31,"3.1",[28,32,36,39],{"date":29,"event":30,"description":31},"2026-07-20","Patch release","Zimbra security team released version 10.1.20 to patch CVE-2026-73570.",{"date":33,"event":34,"description":35},"2026-08-17","Active exploitation reported","CERT Polska reported active exploitation of CVE-2026-73570",{"date":33,"event":37,"description":38},"Active exploitation report","CERT Polska reported threat actors are now exploiting CVE-2026-73570 in attacks.",{"date":40,"event":41,"description":42},"2026-08-20","Detection","Shadowserver flagged 155 compromised instances",[44,47,49,52,54,55],{"vendor":45,"product":46},"Synacor","Zimbra Collaboration Suite (ZCS)",{"vendor":10,"product":48},"Collaboration",{"vendor":50,"product":51},"Microsoft","Windows",{"vendor":45,"product":53},"Zimbra Collaboration Suite",{"vendor":10,"product":53},{"vendor":10,"product":46},"exploitation","2026-09-24T07:12:41.74195+00:00","2026-10-16T12:28:11.355625+00:00",null,{"articles":61},[62,73,83,95],{"slug":63,"title":64,"summary":65,"tags":66,"hero_image_url":70,"story_type":71,"created_at":72},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline","CISA added CVE-2026-18556, an authentication bypass in N-able N-central that allows unauthenticated administrative account takeover in versions through 2026.1, to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a 7 August deadline for US federal civilian agencies.",[67,68,13,12,69],"CVE-2026-18556","N-Able N-Central","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","vulnerability_disclosure","2026-09-21T12:03:34.769619+00:00",{"slug":74,"title":75,"summary":76,"tags":77,"hero_image_url":81,"story_type":56,"created_at":82},"active-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago","Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago","A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.",[78,79,12,80],"SAP","Commerce Cloud","Retail","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Factive-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago.png?v=1fb0e11c19","2026-08-14T15:55:48.267776+00:00",{"slug":84,"title":85,"summary":86,"tags":87,"hero_image_url":93,"story_type":71,"created_at":94},"fortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation","Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation","Fortinet disclosed a critical FortiMail zero-day, CVE-2026-104286, on 1 October 2026. It is exploited in the wild, rated CVSS 9.8 by Fortinet, and was added to CISA's KEV catalog the same day. It affects FortiMail 7.2.0 through 8.0.1; fixes are in 7.4.9, 7.6.7 and 8.0.2.",[88,89,90,91,13,92],"Fortinet","FortiMail","CVE-2026-104286","Path Traversal","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation.png?v=fe5d35df3a","2026-10-17T12:03:14.799873+00:00",{"slug":96,"title":97,"summary":98,"tags":99,"hero_image_url":105,"story_type":71,"created_at":106},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004 Exploited: diffpatch API Abused to Run Shell Commands","CVE-2026-60004 is a critical remote code execution flaw in Gitea's diffpatch API, fixed in Gitea 1.27.1 on 27 July 2026. An attacker with repository write access, which open self-registration lets anyone obtain, can install a Git hook and run commands as the Gitea service account. CISA added it to its KEV catalogue on 25 August 2026 after reports of miner-like payloads on unpatched servers.",[100,101,12,102,103,104],"Gitea","CVE-2026-60004","diffpatch","Git hooks","CVSS 9.8","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81","2026-09-12T12:07:21.883073+00:00"]