Unpatched Zimbra servers are falling to CVE-2026-73570 attacks
Attackers are exploiting unpatched Zimbra servers via CVE-2026-73570; 274 instances compromised, and CISA added the flaw to its KEV catalog.
The Shadowserver Foundation counted at least 274 compromised internet-facing Zimbra Collaboration Suite instances exploited through CVE-2026-73570, up from 155 on August 20. The unauthenticated code injection flaw affects servers with the optional zimbra-snmp package and SNMP notifications enabled, allowing arbitrary OS command execution via crafted SMTP requests. Synacor patched the issue in ZCS v10.1.20 on July 20, 2026, and at least 8,200 instances remain unpatched. CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave US federal civilian agencies three days to remediate and check for compromise.
- 274 Zimbra instances compromised via CVE-2026-73570, per Shadowserver
- Flaw requires non-default setup: zimbra-snmp package installed with SNMP notifications enabled
- Polish CERT first flagged in-the-wild exploitation a week earlier
- CISA KEV addition with a three-day federal remediation deadline
- At least 8,200 servers remain unpatched to v10.1.20
- CVEs
- CVE-2026-73570
- Products
- Zimbra Collaboration Suite
- Organizations
- Shadowserver FoundationCISAPolish CERT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73570 | Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite | 8.9 | 72% | KEVPoC ×5 | KEV |
From the original article
2 min read at helpnetsecurity.com
At least 274 internet-facing Zimbra instances have been compromised by unknown attackers via CVE-2026-73570, the Shadowserver Foundation shared on Monday. Zimbra Collaboration Suite (ZCS) is a communication and collaboration platform popular with organizations that need to have control over their data or can’t afford a pricy alternative service like Microsoft 365 or Google Workspace.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.