Loading story…
Attackers are actively exploiting CVE-2026-73570, a critical unauthenticated remote code execution flaw in Zimbra Collaboration Suite, according to CERT Polska. The vulnerability is an OS command injection issue in Zimbra's SNMP monitoring functionality that can be triggered with specially crafted SMTP requests when the optional zimbra-snmp package is installed, SNMP notifications are enabled, and the swatchdog service is running. Successful exploitation allows arbitrary command execution as the zimbra user, enabling web shell deployment, mailbox theft, persistence, and broader compromise.
Zimbra patched the flaw in version 10.1.20, and defenders are being urged to update immediately because exploitation has already been observed in the wild. CERT Polska recommended reviewing zimbra.log for suspicious activity, checking for unexpected Zimbra service restarts, and inspecting files created by the zimbra user in web application and temporary directories for malicious artifacts. Shadowserver reported that more than 12,100 internet-exposed Zimbra servers remain reachable, mainly in Europe and Asia, underscoring the scale of potential exposure.
See which actors are running it and whether you're in range.
10 events from the most recent confirmed update back to the earliest known activity.
A ProjectDiscovery nuclei-templates pull request published detailed technical analysis and proof-of-concept payloads for CVE-2026-73570, showing how crafted SMTP VRFY input can reach Zimbra's SNMP handling and trigger command injection via dosnmp() and snmptrap execution. The submission included callback-based verification examples and artifact details such as zimbra.log parsing and /tmp output creation.
Shadowserver observed 274 internet-exposed Zimbra instances with exploitation artifacts from attacks exploiting CVE-2026-73570. It also said at least 8,200 unpatched Zimbra instances remained exposed online, while noting the flaw requires a non-default configuration.
CISA added Zimbra Collaboration Suite flaw CVE-2026-73570 to its Known Exploited Vulnerabilities catalog on 2026-08-21, identifying it as an OS command injection issue that can be exploited via crafted SMTP requests. The agency directed organizations to apply vendor mitigations and follow BOD 26-04 and its Forensics Triage Requirements.
Shadowserver Foundation identified 155 internet-facing Zimbra instances compromised through exploitation of CVE-2026-73570. The report marked a quantified escalation of the campaign, which later grew to at least 274 affected systems.
Zimbra fixed the critical command injection vulnerability CVE-2026-73570 in Zimbra Collaboration Suite with the release of version 10.1.20. The vendor advisory said the update addresses command injection in the SNMP monitoring component when notifications are enabled.
Zimbra disclosed CVE-2026-73570, a critical unauthenticated remote code execution flaw in Zimbra Collaboration Suite caused by improper sanitization during SNMP notification processing. The issue can be exploited via crafted SMTP requests when SNMP notifications are enabled.
Reported compromises exploiting CVE-2026-73570 deployed cryptominer or backdoor payloads under /dev/shm and established persistence through the zimbra user's crontab, including an entry executing /dev/shm/.khp every minute. The report also identified associated suspicious filenames and advised containment before cleanup to prevent reinfection.
CERT Polska published defender guidance for investigating possible exploitation, including reviewing zimbra.log for suspicious service-status messages and checking files created by the zimbra user. It also highlighted webapps and /tmp directories as key locations to inspect for web shells, scripts, archives, or other suspicious artifacts.
CERT Polska warned that threat actors are actively exploiting CVE-2026-73570, a critical unauthenticated remote code execution flaw in Zimbra Collaboration Suite. The flaw can be triggered via crafted SMTP requests against deployments with the vulnerable SNMP notification setup.
After learning of CVE-2026-73570 in June, Synacor issued a temporary mitigation for the Zimbra SNMP command-injection flaw before releasing the permanent fix in Zimbra Collaboration Suite 10.1.20.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
29 references tracked. Mallory keeps watching after this page renders.
nki.gov.hu
Open sourcereddit.com
Open sourceitpro.com
Open sourcebleepingcomputer.com
Open sourcemoje.cert.pl
Open sourcecve.org
Open sourcegov.br
Open sourcewiki.zimbra.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity remote code execution flaw, tracked as **`CVE-2026-73570`**, was disclosed and patched in **Zimbra Collaboration** versions earlier than **10.1.20**. The vulnerability affects deployments where the optional **`zimbra-snmp`** package is installed and **SNMP notifications** are enabled, and stems from improper sanitization of untrusted input during SNMP notification processing, classified as **`CWE-78`**. An unauthenticated attacker could exploit the issue by sending specially crafted **SMTP** requests, potentially executing arbitrary operating system commands as the **Zimbra** user. The flaw carries a **CVSS v3.1** vector of **`AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L`**, while CISA SSVC metadata indicates **no known exploitation** and **non-automatable** attack conditions. Italian authorities and vendor guidance urged administrators to update affected systems to **version 10.1.20** or later following the published security bulletin.
Aug 14, 2026
Dutch authorities warned that attackers are actively exploiting **CVE-2024-45519** in Zimbra Collaboration. A specially crafted email sent to a vulnerable Zimbra server can trigger arbitrary code execution, allowing an attacker to compromise the mail platform without requiring user interaction. Successful exploitation can be used to deploy webshells for persistent remote access. Synacor has issued security updates, and organizations should patch affected Zimbra installations immediately, hunt for webshells and other post-exploitation artifacts, and increase monitoring; patching alone will not remove webshells implanted before remediation.
Sep 3, 2026
More than 10,000 internet-exposed **Zimbra Collaboration Suite** servers remain vulnerable to `CVE-2025-48700`, an actively exploited cross-site scripting flaw that affects ZCS versions `8.8.15`, `9.0`, `10.0`, and `10.1`. The bug lets unauthenticated attackers execute arbitrary JavaScript in a victim’s session and steal sensitive data when a user opens a malicious email in the **Zimbra Classic UI**. Synacor released patches in June 2025, but Shadowserver still reported roughly **10,500** exposed unpatched systems, with the largest concentrations in Asia and Europe. **CISA** has added `CVE-2025-48700` to its **Known Exploited Vulnerabilities** catalog and ordered Federal Civilian Executive Branch agencies to secure affected servers within days because the flaw is being abused in the wild. The warning follows a broader pattern of Zimbra vulnerabilities being used in espionage-focused campaigns, with reporting linking earlier exploitation of similar flaws to Russian-aligned groups including **APT28**, **APT29**, and **Winter Vivern** against Ukrainian entities, NATO-aligned organizations, and other targets.
Jun 29, 2026