60
CISA Warns of Zimbra OS Command Injection Vulnerability Active Exploitation (CVE-2026-73570)
CISA added actively exploited Zimbra OS command injection flaw CVE-2026-73570 to its KEV catalog, urging users to patch by August 24, 2026.
CISA warned that Zimbra vulnerability CVE-2026-73570 is being actively exploited in the wild and added it to its Known Exploited Vulnerabilities Catalog. The OS command injection flaw resides in the SNMP monitoring component and is exploitable when SNMP notifications are enabled. Users, including US federal agencies subject to BOD deadlines, were urged to apply fixes before the August 24, 2026 deadline. Qualys ThreatPROTECT published tracking coverage of the KEV addition.
78
60
60
U.S. CISA adds Prettier eslint-config-prettier, Vite Vitejs, Versa Concerto SD-WAN orchestration platform and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog
60
U.S. CISA adds MRLG, PHPMailer, Rails Ruby on Rails, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog
60
60
60
CISA adds recently disclosed Zimbra bug to its Exploited Vulnerabilities Catalog
60
Exploited Zimbra Flaw Highlights Shrinking Window to Patch
CISA gave US agencies three days to patch actively exploited Zimbra flaw CVE-2026-73570, which allows full takeover of user communications.
CISA set a three-day remediation deadline for federal agencies to patch CVE-2026-73570, a Zimbra vulnerability that enables full takeover of a user's communications. The flaw is being actively exploited, underscoring the shrinking window between disclosure and exploitation. Dark Reading frames the case as evidence defenders must accelerate patch cycles.
78
60
60
60
60
60
60
U.S. CISA adds Ivanti EPMM, MDaemon Email Server, Srimax Output Messenger, Zimbra Collaboration, and ZKTeco BioTime flaws to its Known Exploited Vulnerabilities catalog
60
60
60
August 2026 CVE Landscape
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.
68
60
⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
60
60
60
Russia-Linked APT28 Exploited MDaemon Zero
60
60
60
60
60
U.S. CISA adds Cisco Catalyst, Kentico Xperience, PaperCut NG/MF, Synacor ZCS, Quest KACE SMA, and JetBrains TeamCity flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached
60
60
June 2026 CVE Landscape
60
60
60