Zimbra SNMP Flaw CVE-2026-73570 Faces Active Exploitation, CISA Mandates Patching

Key points

• CVE-2026-73570 is a CVSS 8.9 flaw in Zimbra Collaboration Suite versions prior to 10.1.20, patched on July 20, 2026.
• The vulnerability exists when the optional zimbra-snmp package is installed and SNMP notifications are enabled, allowing unauthenticated attackers to execute arbitrary OS commands via crafted SMTP requests.
• CERT Polska reported active exploitation on August 20, 2026, advising admins to check logs for service restarts and files created in specific directories over the last 30 days.
• CISA added the flaw to its KEV catalog on August 21, 2026, mandating that Federal Civilian Executive Branch agencies apply fixes by August 24, 2026.
• Shadowserver data as of August 24, 2026, shows 267 compromised Zimbra instances, with the US (46), Sweden (21), France (20), and Germany (17) having the highest numbers.

Background

Zimbra has a history of severe vulnerabilities exploited by state-sponsored actors. In March 2026, APT28 targeted Ukrainian government ZCS servers via a stored XSS flaw. Earlier in 2026, CISA flagged multiple exploited SharePoint and SonicWall flaws, highlighting a broader trend of urgent patching requirements for enterprise software. The current Zimbra incident follows a pattern of rapid exploitation following disclosure, similar to recent GeoServer and Langflow incidents.

How outlets are covering it

BleepingComputer and SecurityWeek emphasize the immediate threat and the lack of attribution for the current campaign, noting that while the threat actor is unknown, Zimbra flaws are frequently linked to Russian and Chinese state-sponsored groups. The Hacker News provides specific technical details from the NVD and highlights the CISA deadline, while CCB Belgium focuses on the high severity (CVSS 8.9) and the need for immediate patching and monitoring. All sources agree on the active exploitation status but differ in the depth of technical indicators and regulatory deadlines provided.

Why it matters

Zimbra Collaboration Suite is used by hundreds of millions of users, including government agencies. Active exploitation of a critical RCE flaw poses a significant risk to data confidentiality and system integrity. The CISA mandate underscores the urgency for federal agencies, while the high number of compromised instances globally indicates widespread impact. Failure to patch could lead to full server compromise, credential theft, and lateral movement.

What to watch

Organizations should immediately upgrade to Zimbra Collaboration Suite version 10.1.20 or later. Admins must review logs for indicators of compromise, such as unexpected service restarts and files in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/. Federal agencies must comply with the CISA KEV deadline of August 24, 2026. Continued monitoring for suspicious activity and ensuring SNMP notifications are disabled if not needed is recommended.