What Changed
Shadowserver says attackers have already compromised hundreds of internet-facing Zimbra servers through CVE-2026-73570. “274 instances seen compromised in our scans for exploitation artifacts on 2026-08-22,” the organization reported, adding that it sees at least 8,200 unpatched instances. Not all of those are exploitable, since the flaw requires a non-default configuration.
The vulnerability is a command injection in Zimbra Collaboration Suite’s SNMP monitoring component that gives unauthenticated attackers remote code execution when SNMP notifications are enabled. Synacor fixed it in ZCS 10.1.20 on July 20. CERT Polska flagged exploitation last week, and CISA added the flaw to KEV with an August 24 federal deadline.
Why This Is Now An Incident-Response Problem
A count of confirmed compromises means patching alone is no longer the answer for exposed servers. Any ZCS host that ran a vulnerable build with SNMP notifications enabled should be checked for persistence before it is declared clean.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Zimbra is a frequent target. Earlier this year Seqrite Labs reported APT28 abusing a Zimbra XSS flaw against Ukrainian government servers, and U.S. and UK agencies have previously warned of APT29 targeting Zimbra. Mail servers hold exactly the data espionage groups want.
What To Verify First
- Upgrade to ZCS 10.1.20 or later on every host.
- Check for unexpected Zimbra service restarts.
- Look for files created by the zimbra user in the past 30 days under
/opt/zimbra/jetty/webapps/,/opt/zimbra/jetty_base/webapps/and/tmp/. - If you find artifacts, preserve evidence, rebuild the host and rotate credentials stored on or used by the server.
What Teams May Be Underestimating
Shadowserver’s numbers only cover what external scans can see. Organizations should assume their own server could be one of them until local checks say otherwise.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
