[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7VKEmfV8pvsyySyMAzXXozo8w52hBD7dJb9UQALBumc":3,"$fLnkS3j_tCuFSGoQY1ecQ6O4hrKZLZrm_Lbi9C4veEY8":74},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":70,"created_at":71,"updated_at":72,"published_at":73},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Unauthenticated RCE in Zimbra's SNMP notification handler is being actively exploited against internet-facing servers, with CISA ordering a 3-day patch deadline.","Shadowserver found 274 internet-facing Zimbra Collaboration Suite servers compromised in-the-wild via CVE-2026-73570, an unauthenticated OS command injection in the zimbra-snmp package that lets attackers execute arbitrary commands as the zimbra user via crafted SMTP requests.",[10,11,12,13,14],"Zimbra","CVE-2026-73570","RCE","CISA KEV","Shadowserver","# 274 Zimbra Servers Compromised in the Wild via CVE-2026-73570\n\n*Unauthenticated RCE in Zimbra's SNMP notification handler is being actively exploited against internet-facing servers, with CISA ordering a 3-day patch deadline.*\n\n**Tags:** `Zimbra` `CVE-2026-73570` `RCE` `CISA KEV` `Shadowserver`\n\n> Shadowserver found 274 internet-facing Zimbra Collaboration Suite servers compromised in-the-wild via CVE-2026-73570, an unauthenticated OS command injection in the zimbra-snmp package that lets attackers execute arbitrary commands as the zimbra user via crafted SMTP requests.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-73570 | 8.9 | 32.4% | ✅ listed | — | 80.25 (High) |\n| CVE-2026-19478 | 9.4 | 5.8% | — | — | 54.12 (Medium) |\n| CVE-2026-69836 | 10.0 | 1.6% | — | — | 54.3 (Medium) |\n\n## 274 Zimbra servers already compromised in the wild\n\nShadowserver has identified 274 internet-facing Zimbra Collaboration Suite instances compromised in the wild via CVE-2026-73570, the nonprofit shared Monday, Aug. 24.\n\nThe Polish CERT first flagged active exploitation on Aug. 17, and Shadowserver’s daily scans began picking up the compromised instances starting Aug. 20, with the count climbing over the following days.\n\nShadowserver also counted at least 8,200 additional instances still running ZCS versions prior to 10.1.20, though only those with the optional `zimbra-snmp` package installed and SNMP notifications enabled are exposed to the unauthenticated RCE.\n\n## The flaw: unauthenticated RCE via SNMP notification\n\nCVE-2026-73570 is a command injection flaw (CWE-78) in Zimbra Collaboration Suite (ZCS) prior to 10.1.20, which Synacor patched in a release on July 20, 2026. The bug lives in the SNMP notification handler and fires when the optional `zimbra-snmp` package is installed and SNMP notifications are enabled via the `snmp_notify` parameter.\n\nAn unauthenticated attacker sends a crafted SMTP request to the Zimbra server, which reaches the vulnerable SNMP notification logic and executes an arbitrary OS command as the `zimbra` user. The NVD entry describes the root cause as \"improper sanitization of untrusted input during SNMP notification processing.\"\n\nThe flaw scores CVSS 8.9 (v3.1) and carries an EPSS score of 32.4% at the 98th percentile, indicating a high likelihood of exploitation. CISA added it to its Known Exploited Vulnerabilities catalog on Aug. 21, 2026, and ordered federal civilian agencies to patch by Aug. 24. No public PoC has been released yet.\n\n## Timeline: disclosed June 20, patched July 20, exploited Aug 17\n\nZimbra disclosed CVE-2026-73570 on June 26, 2026, giving administrators a temporary mitigation to hold until the full fix landed. The patch shipped in ZCS v10.1.20 on July 20, 2026, closing the command injection in the SNMP notification handler.\n\nCERT Polska flagged in-the-wild exploitation on Aug. 17, sharing log entries and created files that confirm the compromise. CISA followed on Aug. 21, adding the CVE to its Known Exploited Vulnerabilities catalog and setting a three-day deadline for federal civilian agencies to patch or stop using the technology by Aug. 24.\n\n## Why this matters for Zimbra admins\n\nZimbra Collaboration Suite is the self-hosted mail stack that organizations pick when they need direct control over their data or can’t justify the cost of Microsoft 365 or Google Workspace. It runs as a single `zimbra` user, which is why the RCE here is so consequential: the attacker lands in the same account that handles mail access, password resets, archiving, and backups. No root needed.\n\nThe SNMP notification path is the entry point. It’s not enabled by default, but it’s commonly turned on for monitoring via the `snmp_notify` parameter. The `zimbra-snmp` package must be installed, and `swatchdog` must be running. That’s why only a subset of the 8,200 unpatched instances are actually exposed — the rest are running the default config without the optional package.\n\nCISA’s three-day KEV deadline — from Aug. 21 to Aug. 24 — signals high urgency. The agency ordered federal civilian agencies to patch or stop using the technology within 72 hours. Admins should be checking SMTP logs for suspicious activity dating back to Aug. 21, when the first in-the-wild exploitation was confirmed.\n\n## Key points\n\n- CVE-2026-73570 is a pre-auth RCE (CVSS 8.9) in Zimbra Collaboration Suite before 10.1.20, triggered when the optional zimbra-snmp package is installed and SNMP notifications are enabled.\n- 274 internet-facing Zimbra servers were confirmed compromised in-the-wild by Shadowserver, with exploitation first flagged by CERT Polska on August 17, 2026.\n- CISA added the CVE to its KEV catalog on August 21, 2026 and gave US federal civilian agencies a 3-day deadline (due August 24) to patch or isolate.\n- The flaw is a command injection (CWE-78) in SNMP notification processing that executes arbitrary OS commands as the 'zimbra' user via unauthenticated SMTP requests.\n- Zimbra patched the bug in v10.1.20 released July 20, 2026; at least 8,200 instances remain unpatched, though only those with zimbra-snmp + snmp_notify are exploitable.\n\n## Further reading & sources\n\n- [Unpatched Zimbra servers are falling to CVE-2026-73570 attacks - Help Net Security](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F08\u002F25\u002Fzimbra-cve-2026-73570-compromised) — Helpnet Security\n- [CVE-2026-73570: Zimbra RCE Exploited](https:\u002F\u002Fsocradar.io\u002Fblog\u002Fcve-2026-73570-zimbra-rce)\n- [Zimbra vulnerability CVE-2026-73570: find impacted assets](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fzimbra)\n- [Critical Zimbra RCE flaw now actively exploited in attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcritical-zimbra-rce-flaw-now-actively-exploited-in-attacks\u002F)\n- [Exploited Zimbra Flaw Highlights Shrinking Window to Patch](https:\u002F\u002Fwww.darkreading.com\u002Fvulnerabilities-threats\u002Fzimbra-flaw-exploitation-shrinking-window-patch)\n- [Microsoft patches 398 flaws; Zimbra exploitation deadline…](https:\u002F\u002Fdefend.network\u002Fbriefings\u002Fmicrosoft-patch-tuesday-zimbra-exploitation-android-veh-2026-08-24.html)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2",{"cves":18,"timeline":41,"technologies":57},[19,28,34],{"id":20,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},"CVE-2026-19478",false,"\u002Fvulnerabilities\u002FCVE-2026-19478",9.4,0.602,"Medium",55.58,"3.1",{"id":29,"kev":21,"poc":21,"url":30,"cvss":31,"epss":32,"risk_band":25,"risk_score":33,"cvss_version":27},"CVE-2026-69836","\u002Fvulnerabilities\u002FCVE-2026-69836",10,0.0153,54.3,{"id":11,"kev":35,"poc":21,"url":36,"cvss":37,"epss":38,"risk_band":39,"risk_score":40,"cvss_version":27},true,"\u002Fvulnerabilities\u002FCVE-2026-73570",8.9,0.7166,"High",80.25,[42,46,50,53],{"date":43,"event":44,"description":45},"2026-07-20","Patch release","Zimbra security team released version 10.1.20 to patch CVE-2026-73570.",{"date":47,"event":48,"description":49},"2026-08-17","Active exploitation reported","CERT Polska reported active exploitation of CVE-2026-73570",{"date":47,"event":51,"description":52},"Active exploitation report","CERT Polska reported threat actors are now exploiting CVE-2026-73570 in attacks.",{"date":54,"event":55,"description":56},"2026-08-20","Detection","Shadowserver flagged 155 compromised instances",[58,61,63,66,68,69],{"vendor":59,"product":60},"Synacor","Zimbra Collaboration Suite (ZCS)",{"vendor":10,"product":62},"Collaboration",{"vendor":64,"product":65},"Microsoft","Windows",{"vendor":59,"product":67},"Zimbra Collaboration Suite",{"vendor":10,"product":67},{"vendor":10,"product":60},"exploitation","2026-09-24T07:12:41.74195+00:00","2026-10-16T12:28:11.355625+00:00",null,{"articles":75},[76,87,97,110],{"slug":77,"title":78,"summary":79,"tags":80,"hero_image_url":84,"story_type":85,"created_at":86},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-Able N-Central RCE with 3-day federal deadline","CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.",[81,82,13,12,83],"CVE-2026-18556","N-Able N-Central","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","vulnerability_disclosure","2026-09-21T12:03:34.769619+00:00",{"slug":88,"title":89,"summary":90,"tags":91,"hero_image_url":95,"story_type":70,"created_at":96},"active-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago","Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago","A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.",[92,93,12,94],"SAP","Commerce Cloud","Retail","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Factive-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago.png?v=1fb0e11c19","2026-08-14T15:55:48.267776+00:00",{"slug":98,"title":99,"summary":100,"tags":101,"hero_image_url":107,"story_type":108,"created_at":109},"greynoise-labs-reveals-34k-sessions-scanning-ivanti-connect-secure-for-cve-2025-","GreyNoise Labs reveals 34k+ sessions scanning Ivanti Connect Secure for CVE-2025-0282","Two parallel reconnaissance campaigns are scanning internet-facing Ivanti Connect Secure instances for CVE-2025-0282, with the high-volume cluster concentrated in AS213790 (Limited Network LTD) and the second campaign distributed across ~6,000 unique IPs.",[102,103,104,105,106,12],"Ivanti Connect Secure","CVE-2025-0282","GreyNoise Labs","AS213790","Limited Network LTD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgreynoise-labs-reveals-34k-sessions-scanning-ivanti-connect-secure-for-cve-2025-.png?v=ea7577722f","campaign","2026-09-14T07:09:53.792428+00:00",{"slug":111,"title":112,"summary":113,"tags":114,"hero_image_url":120,"story_type":85,"created_at":121},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004: Unauthenticated Attackers Execute Shell Commands via diffpatch","Gitea disclosed CVE-2026-60004, a critical remote code execution vulnerability in the diffpatch feature that allows unauthenticated remote attackers to write malicious Git hooks and execute arbitrary shell commands as the Gitea process user on default installations with open self-registration enabled.",[115,116,12,117,118,119],"Gitea","CVE-2026-60004","diffpatch","Git hooks","CVSS 9.8","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81","2026-09-12T12:07:21.883073+00:00"]