Loading story…
Attackers are actively exploiting CVE-2026-73570, an unauthenticated OS command-injection flaw in the Zimbra Collaboration Suite SNMP notification path. A crafted SMTP request can execute commands as the zimbra service account when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Zimbra fixed the issue in version 10.1.20, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.
Microsoft observed compromises involving redundant JSP web shells, reverse shells, escalation to root, and persistent access through systemd, cron, SSH trust relationships, and the Zimclient2 remote-access agent. Operators moved laterally across Zimbra clusters and collected service credentials, authentication secrets, LDAP data, mailbox databases, certificates, and archived mailbox backups, including an attempted AzCopy transfer of archived mail. Organizations should urgently patch, or remove zimbra-snmp and disable SNMP notifications where patching is delayed; they should also restrict SMTP/SNMP exposure, hunt for web shells and persistence, investigate reverse-shell activity, and rotate Zimbra credentials and secrets.
See which actors are running it and whether you're in range.
10 events from the most recent confirmed update back to the earliest known activity.
CERT Polska identified CVE-2026-73570 as actively exploited and published indicators of compromise associated with the Zimbra exploitation activity.
The unauthenticated Zimbra SNMP notification command-injection vulnerability was publicly disclosed after pre-disclosure probing and exploitation activity had been observed.
CERT Polska publicly highlighted that CVE-2026-73570 was being actively exploited.
Two out-of-band scanning toolsets probed the vulnerable command-injection path to validate execution, using HTTP, DNS, ICMP, and identity-check callbacks without necessarily delivering payloads.
Unidentified attackers exploited CVE-2026-73570 across organizations in multiple regions and industries, executing commands as the zimbra account. The observed activity included JSP webshells, reverse shells, cron and systemd persistence, privilege escalation, lateral movement across trusted Zimbra nodes, and deployment of the Zimclient2 remote-access agent.
Zimbra released Collaboration Suite version 10.1.20, which remediated the unauthenticated OS command-injection flaw in the SNMP notification path. The issue affects deployments with the optional zimbra-snmp package installed and SNMP notifications enabled.
Gurucul reported infrastructure and malware indicators associated with exploitation of CVE-2026-73570, including attacker domains, IP addresses, a malicious S3-hosted download URL, SHA-256 hashes, a referenced privilege-escalation toolkit, and a blockchain contract address. The report also identified use of memory-backed payloads during the already documented post-exploitation activity.
Shadowserver Foundation scans identified 274 separate compromised Zimbra Collaboration Suite instances amid exploitation of CVE-2026-73570. The organization was also tracking roughly 10,000 internet-exposed Zimbra instances at the time of reporting.
CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog and directed U.S. federal agencies to remediate the issue by August 24, 2026.
During the compromises, attackers recovered Zimbra service credentials and queried LDAP for pre-authentication, authentication-token, and two-factor secrets. A Zimbra-specific Go payload also exported mailbox-related database content and collected certificates, private keys, mail rules, and configuration data; one observed actor attempted to send an archived mailbox backup to Azure Blob storage, though completion was unconfirmed.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecommunity.gurucul.com
Open sourcecybersecuritynews.com
Open sourcearstechnica.com
Open sourcethehackernews.com
Open sourcemicrosoft.com
Open sourcecert.pa
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-73570**, a critical unauthenticated remote code execution flaw in **Zimbra Collaboration Suite**, according to CERT Polska. The vulnerability is an OS command injection issue in Zimbra's SNMP monitoring functionality that can be triggered with specially crafted SMTP requests when the optional `zimbra-snmp` package is installed, SNMP notifications are enabled, and the `swatchdog` service is running. Successful exploitation allows arbitrary command execution as the `zimbra` user, enabling web shell deployment, mailbox theft, persistence, and broader compromise. Zimbra patched the flaw in **version 10.1.20**, and defenders are being urged to update immediately because exploitation has already been observed in the wild. CERT Polska recommended reviewing `zimbra.log` for suspicious activity, checking for unexpected Zimbra service restarts, and inspecting files created by the `zimbra` user in web application and temporary directories for malicious artifacts. Shadowserver reported that more than **12,100** internet-exposed Zimbra servers remain reachable, mainly in Europe and Asia, underscoring the scale of potential exposure.
Sep 2, 2026
Dutch authorities warned that attackers are actively exploiting **CVE-2024-45519** in Zimbra Collaboration. A specially crafted email sent to a vulnerable Zimbra server can trigger arbitrary code execution, allowing an attacker to compromise the mail platform without requiring user interaction. Successful exploitation can be used to deploy webshells for persistent remote access. Synacor has issued security updates, and organizations should patch affected Zimbra installations immediately, hunt for webshells and other post-exploitation artifacts, and increase monitoring; patching alone will not remove webshells implanted before remediation.
Sep 3, 2026
A high-severity remote code execution flaw, tracked as **`CVE-2026-73570`**, was disclosed and patched in **Zimbra Collaboration** versions earlier than **10.1.20**. The vulnerability affects deployments where the optional **`zimbra-snmp`** package is installed and **SNMP notifications** are enabled, and stems from improper sanitization of untrusted input during SNMP notification processing, classified as **`CWE-78`**. An unauthenticated attacker could exploit the issue by sending specially crafted **SMTP** requests, potentially executing arbitrary operating system commands as the **Zimbra** user. The flaw carries a **CVSS v3.1** vector of **`AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L`**, while CISA SSVC metadata indicates **no known exploitation** and **non-automatable** attack conditions. Italian authorities and vendor guidance urged administrators to update affected systems to **version 10.1.20** or later following the published security bulletin.
Aug 14, 2026