Over 270 Zimbra Servers Reportedly Compromised via CVE-2026-73570
Summary
Shadowserver reported 274 Zimbra instances with exploitation artifacts for CVE-2026-73570, an unauthenticated RCE affecting systems with SNMP notifications enabled. Synacor patched it in ZCS 10.1.20; CISA ordered federal agencies to patch.
Key points
- CVE-2026-73570 is an unauthenticated remote-code-execution flaw caused by command injection in Zimbra’s SNMP monitoring component when SNMP notifications are enabled.
- Shadowserver reported 274 instances with exploitation artifacts in scans on August 22; this is evidence of a claim, not independent confirmation of each compromise.
- Shadowserver also observed at least 8,200 unpatched instances, noting that this does not mean they are exploitable because the vulnerable configuration is not enabled by default.
- Synacor fixed the flaw in Zimbra Collaboration Suite version 10.1.20, released July 20.
- CERT Polska warned of in-the-wild exploitation; CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave U.S. federal civilian agencies three days to patch.
- CERT Polska advised checking for unexpected Zimbra service restarts and files created by the zimbra user in specified web application and temporary directories.
Article Details
- Vulnerability Types
- Command injection
- Unauthenticated remote code execution
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Threat Actors
APT28The article says APT28 previously exploited a stored XSS vulnerability in Zimbra to breach Ukrainian government servers.Cozy BearThe article identifies Cozy Bear as a tracking name for the Russian Foreign Intelligence Service hackers also tracked as APT29 and Midnight Blizzard, who previously compromised Zimbra servers.ICE RELICThe article says Russian Foreign Intelligence Service hackers tracked as APT29, Midnight Blizzard, and Cozy Bear previously compromised Zimbra servers; it presents these names as tracking names for the same hackers.Midnight BlizzardThe article identifies Midnight Blizzard as a tracking name for the Russian Foreign Intelligence Service hackers also tracked as APT29 and Cozy Bear, who previously compromised Zimbra servers.Winter VivernThe article says Russian Winter Vivern cyber spies previously exploited a reflected XSS vulnerability to steal emails from NATO-aligned accounts by targeting Zimbra webmail portals.