CISA Mandates Urgent Patching of Exploited Zimbra SNMP Flaw

Key points

• CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to patch by August 24, 2026.
• The vulnerability, fixed in Zimbra version 10.1.20 released on July 20, 2026, carries a CVSS score of 8.9 and affects systems with the optional zimbra-snmp package enabled.
• CERT Polska confirmed active exploitation, advising administrators to check logs for unexpected service restarts and suspicious files in specific directories over the last 30 days.
• Shadowserver identified over 12,000 exposed Zimbra servers and confirmed 267 compromised instances as of August 24, 2026, with the U.S., Sweden, France, and Germany reporting the highest numbers.
• The flaw allows unauthenticated attackers to execute arbitrary operating system commands by sending specially crafted SMTP requests to the SNMP monitoring component.

Background

Zimbra Collaboration Suite has been a frequent target for state-sponsored actors and cybercriminals in recent years. In March 2026, APT28 exploited a stored cross-site scripting vulnerability to target Ukrainian government servers, while in October 2024, APT29 targeted Zimbra servers to steal email credentials. This latest incident follows a pattern of CISA issuing urgent patching directives for actively exploited vulnerabilities in enterprise software, similar to recent alerts for SharePoint and Langflow flaws.

How outlets are covering it

BleepingComputer and The Hacker News both emphasize the severity of the unauthenticated remote code execution risk and the specific technical details of the command injection flaw. SecurityWeek highlights the broader context of Zimbra being a recurring target for Russian and Chinese state-sponsored hackers, noting that CISA's KEV catalog already includes 18 Zimbra vulnerabilities. All sources agree on the urgency of patching but differ in emphasis: BleepingComputer focuses on the CISA mandate, while The Hacker News provides more detail on the compromised instances by country. CERT Polska's initial alert is cited by all as the trigger for the active exploitation warning.

Why it matters

The active exploitation of CVE-2026-73570 poses a significant risk to organizations using Zimbra Collaboration Suite, particularly those with SNMP notifications enabled. The unauthenticated nature of the attack vector means that even systems without valid credentials are vulnerable, potentially leading to full server compromise, data theft, and lateral movement. The CISA mandate underscores the criticality of the flaw for U.S. federal agencies, and the global scale of compromised instances indicates a widespread threat that requires immediate attention from all Zimbra users.

What to watch

Organizations using Zimbra Collaboration Suite should immediately update to version 10.1.20 or later to patch CVE-2026-73570. Administrators should review logs for indicators of compromise, such as unexpected service restarts and suspicious files in the /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ directories. CISA will monitor compliance among federal agencies, and security teams should continue to monitor for further exploitation attempts and potential follow-up attacks.