What Changed
CISA added CVE-2026-73570, an OS command injection flaw in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities catalog on Friday, August 21, and gave federal civilian agencies three days, until August 24, to fix it. The order followed CERT Polska’s warning earlier in the week that the flaw was being exploited.
The bug sits in the SNMP monitoring component. When SNMP notifications are enabled, “an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user,” according to the advisory text quoted by BleepingComputer. Zimbra fixed it in version 10.1.20, released July 20.
Why The Deadline Is So Short
CISA moved to three-day deadlines for critical, exploited flaws under BOD 26-04, which tiers remediation by risk. This entry fits that tier: no login and no user interaction are needed, and the attack arrives over SMTP, the one port a mail server cannot close. Jason Soroko of Sectigo told Dark Reading: “Exploitation is confirmed, and the vulnerable path can be reached without credentials through SMTP when Zimbra’s optional SNMP package and notifications are enabled.”
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Shadowserver counts more than 12,000 Zimbra servers exposed online, though it cannot tell how many are honeypots or already secured.
What To Verify First
- Upgrade every ZCS host to 10.1.20 or later.
- Determine whether the optional
zimbra-snmppackage is installed and notifications are enabled. - Follow CERT Polska’s checks: unexpected Zimbra service restarts, and files created by the zimbra user in the last 30 days in
/opt/zimbra/jetty/webapps/,/opt/zimbra/jetty_base/webapps/and/tmp/.
What Teams May Be Underestimating
The fix shipped as a routine point release a month before exploitation was confirmed. On Zimbra, point releases deserve emergency-patch treatment.
Source Context
This item was rebuilt from the following primary sources and original reporting:
- CISA: CISA Adds One Known Exploited Vulnerability to Catalog (August 21, 2026)
- BleepingComputer: CISA orders urgent patching of actively exploited Zimbra flaw
- Dark Reading: Exploited Zimbra Flaw Highlights Shrinking Window to Patch
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
