At least 274 internet-facing Zimbra instances have been compromised by unknown attackers via CVE-2026-73570, the Shadowserver Foundation shared on Monday.
About CVE-2026-73570
Zimbra Collaboration Suite (ZCS) is a communication and collaboration platform popular with organizations that need to have control over their data or can’t afford a pricy alternative service like Microsoft 365 or Google Workspace.
CVE-2026-73570 is a code injection flaw Synacor patched in ZCS v10.1.20, released on July 20, 2026.
The vulnerability was first disclosed on June 26, 2026, and admins were able to implement a temporary mitigation until the fix was released.
CVE-2026-73570 affects Zimbra mailservers that have the (optional) zimbra-snmp package installed and SNMP notifications enabled.
“Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user,” says the flaw’s CVE entry.
In-the-wild exploitation
The Polish CERT flagged in-the-wild exploitation of CVE-2026-73570 a week ago, and shared a list of log entries and created files that point to compromise.
With those available, the Shadowserver Foundation – a nonprofit that performs daily internet-wide scans covering most of the routable IPv4 address space, looking for open ports and services, TLS certificate data, vulnerability indicators, and more – flagged 155 compromised instances on August 20, and the number kept rising in the following days.
They also noted that there are at least 8200 instances that haven’t yet been updated to ZCS v10.1.20, but pointed out that not all may be open to attack via CVE-2026-73570, as the vulnerability is exploitable only in a non-default configuration.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog late last week, and ordered US federal civilian agencies to address it within three days and check for evidence of compromise.
Zimbra vulnerabilities are generally leveraged both by state-sponsored hackers (often as zero-days) and opportunistic cybercriminals. Who is behind these latest attacks is still unknown.