Loading story…
Dutch authorities warned that attackers are actively exploiting CVE-2024-45519 in Zimbra Collaboration. A specially crafted email sent to a vulnerable Zimbra server can trigger arbitrary code execution, allowing an attacker to compromise the mail platform without requiring user interaction.
Successful exploitation can be used to deploy webshells for persistent remote access. Synacor has issued security updates, and organizations should patch affected Zimbra installations immediately, hunt for webshells and other post-exploitation artifacts, and increase monitoring; patching alone will not remove webshells implanted before remediation.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
The NCSC updated its notice with a tool and Dutch- and English-language guidance for detecting webshells deployed through CVE-2024-45519 before a server was patched.
The NCSC reported signals of active exploitation of CVE-2024-45519, which can be triggered by a specially crafted email and permits arbitrary code execution on a vulnerable Zimbra server.
Synacor released security updates to remediate CVE-2024-45519 in Zimbra Collaboration. Applying the updates does not remove webshells that may have been installed before patching.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-73570**, a critical unauthenticated remote code execution flaw in **Zimbra Collaboration Suite**, according to CERT Polska. The vulnerability is an OS command injection issue in Zimbra's SNMP monitoring functionality that can be triggered with specially crafted SMTP requests when the optional `zimbra-snmp` package is installed, SNMP notifications are enabled, and the `swatchdog` service is running. Successful exploitation allows arbitrary command execution as the `zimbra` user, enabling web shell deployment, mailbox theft, persistence, and broader compromise. Zimbra patched the flaw in **version 10.1.20**, and defenders are being urged to update immediately because exploitation has already been observed in the wild. CERT Polska recommended reviewing `zimbra.log` for suspicious activity, checking for unexpected Zimbra service restarts, and inspecting files created by the `zimbra` user in web application and temporary directories for malicious artifacts. Shadowserver reported that more than **12,100** internet-exposed Zimbra servers remain reachable, mainly in Europe and Asia, underscoring the scale of potential exposure.
Sep 2, 2026
More than 10,000 internet-exposed **Zimbra Collaboration Suite** servers remain vulnerable to `CVE-2025-48700`, an actively exploited cross-site scripting flaw that affects ZCS versions `8.8.15`, `9.0`, `10.0`, and `10.1`. The bug lets unauthenticated attackers execute arbitrary JavaScript in a victim’s session and steal sensitive data when a user opens a malicious email in the **Zimbra Classic UI**. Synacor released patches in June 2025, but Shadowserver still reported roughly **10,500** exposed unpatched systems, with the largest concentrations in Asia and Europe. **CISA** has added `CVE-2025-48700` to its **Known Exploited Vulnerabilities** catalog and ordered Federal Civilian Executive Branch agencies to secure affected servers within days because the flaw is being abused in the wild. The warning follows a broader pattern of Zimbra vulnerabilities being used in espionage-focused campaigns, with reporting linking earlier exploitation of similar flaws to Russian-aligned groups including **APT28**, **APT29**, and **Winter Vivern** against Ukrainian entities, NATO-aligned organizations, and other targets.
Jun 29, 2026
CISA added **CVE-2025-66376** to its Known Exploited Vulnerabilities catalog after reports of active exploitation against **Zimbra Collaboration Suite**. The high-severity flaw affects the **Classic UI** and lets an unauthenticated remote attacker trigger **stored/persistent XSS** by sending malicious HTML email that abuses the CSS `@import` directive, potentially exposing sensitive information and creating a path to further compromise. The vulnerability affects Zimbra Collaboration Suite versions earlier than **10.0.18** and **10.1.13**. Synacor patched the issue in November 2025, and Zimbra security advisories list the fixed releases; organizations running vulnerable versions have been urged to upgrade immediately to **10.0.18**, **10.1.13**, or later because the flaw is already being exploited in the wild.
Jul 24, 2026