All news
exploitation

Precursor Intelligence

274 Zimbra Servers Compromised in the Wild via CVE-2026-73570

Unauthenticated RCE in Zimbra's SNMP notification handler is being actively exploited against internet-facing servers, with CISA ordering a 3-day patch deadline.

24 September 2026
ZimbraCVE-2026-73570RCECISA KEVShadowserver
274 Zimbra Servers Compromised in the Wild via CVE-2026-73570

At a glance

3 CVEs

Vulnerabilities

CVECVSSEPSSKEVPoCPRS risk
CVE-2026-194789.460.2%——56 · Medium
CVE-2026-69836101.5%——54 · Medium
CVE-2026-735708.971.7%Exploited—80 · High

Technology affected

Synacor · Zimbra Collaboration Suite (ZCS)Zimbra · CollaborationMicrosoft · WindowsSynacor · Zimbra Collaboration SuiteZimbra · Zimbra Collaboration SuiteZimbra · Zimbra Collaboration Suite (ZCS)

Timeline

  1. Patch release

    Zimbra security team released version 10.1.20 to patch CVE-2026-73570.

  2. Active exploitation reported

    CERT Polska reported active exploitation of CVE-2026-73570

  3. Active exploitation report

    CERT Polska reported threat actors are now exploiting CVE-2026-73570 in attacks.

  4. Detection

    Shadowserver flagged 155 compromised instances

Vulnerability details

CVE CVSS EPSS KEV PoC PRS risk
CVE-2026-73570 8.9 32.4% ✅ listed — 80.25 (High)
CVE-2026-19478 9.4 5.8% — — 54.12 (Medium)
CVE-2026-69836 10.0 1.6% — — 54.3 (Medium)

274 Zimbra servers already compromised in the wild

Shadowserver has identified 274 internet-facing Zimbra Collaboration Suite instances compromised in the wild via CVE-2026-73570, the nonprofit shared Monday, Aug. 24.

The Polish CERT first flagged active exploitation on Aug. 17, and Shadowserver’s daily scans began picking up the compromised instances starting Aug. 20, with the count climbing over the following days.

Shadowserver also counted at least 8,200 additional instances still running ZCS versions prior to 10.1.20, though only those with the optional zimbra-snmp package installed and SNMP notifications enabled are exposed to the unauthenticated RCE.

The flaw: unauthenticated RCE via SNMP notification

CVE-2026-73570 is a command injection flaw (CWE-78) in Zimbra Collaboration Suite (ZCS) prior to 10.1.20, which Synacor patched in a release on July 20, 2026. The bug lives in the SNMP notification handler and fires when the optional zimbra-snmp package is installed and SNMP notifications are enabled via the snmp_notify parameter.

An unauthenticated attacker sends a crafted SMTP request to the Zimbra server, which reaches the vulnerable SNMP notification logic and executes an arbitrary OS command as the zimbra user. The NVD entry describes the root cause as "improper sanitization of untrusted input during SNMP notification processing."

The flaw scores CVSS 8.9 (v3.1) and carries an EPSS score of 32.4% at the 98th percentile, indicating a high likelihood of exploitation. CISA added it to its Known Exploited Vulnerabilities catalog on Aug. 21, 2026, and ordered federal civilian agencies to patch by Aug. 24. No public PoC has been released yet.

Timeline: disclosed June 20, patched July 20, exploited Aug 17

Zimbra disclosed CVE-2026-73570 on June 26, 2026, giving administrators a temporary mitigation to hold until the full fix landed. The patch shipped in ZCS v10.1.20 on July 20, 2026, closing the command injection in the SNMP notification handler.

CERT Polska flagged in-the-wild exploitation on Aug. 17, sharing log entries and created files that confirm the compromise. CISA followed on Aug. 21, adding the CVE to its Known Exploited Vulnerabilities catalog and setting a three-day deadline for federal civilian agencies to patch or stop using the technology by Aug. 24.

Why this matters for Zimbra admins

Zimbra Collaboration Suite is the self-hosted mail stack that organizations pick when they need direct control over their data or can’t justify the cost of Microsoft 365 or Google Workspace. It runs as a single zimbra user, which is why the RCE here is so consequential: the attacker lands in the same account that handles mail access, password resets, archiving, and backups. No root needed.

The SNMP notification path is the entry point. It’s not enabled by default, but it’s commonly turned on for monitoring via the snmp_notify parameter. The zimbra-snmp package must be installed, and swatchdog must be running. That’s why only a subset of the 8,200 unpatched instances are actually exposed — the rest are running the default config without the optional package.

CISA’s three-day KEV deadline — from Aug. 21 to Aug. 24 — signals high urgency. The agency ordered federal civilian agencies to patch or stop using the technology within 72 hours. Admins should be checking SMTP logs for suspicious activity dating back to Aug. 21, when the first in-the-wild exploitation was confirmed.

Key points

  • CVE-2026-73570 is a pre-auth RCE (CVSS 8.9) in Zimbra Collaboration Suite before 10.1.20, triggered when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
  • 274 internet-facing Zimbra servers were confirmed compromised in-the-wild by Shadowserver, with exploitation first flagged by CERT Polska on August 17, 2026.
  • CISA added the CVE to its KEV catalog on August 21, 2026 and gave US federal civilian agencies a 3-day deadline (due August 24) to patch or isolate.
  • The flaw is a command injection (CWE-78) in SNMP notification processing that executes arbitrary OS commands as the 'zimbra' user via unauthenticated SMTP requests.
  • Zimbra patched the bug in v10.1.20 released July 20, 2026; at least 8,200 instances remain unpatched, though only those with zimbra-snmp + snmp_notify are exploitable.

Further reading & sources