CISA orders rapid patch for actively exploited Zimbra flaw
CISA has ordered U.S. federal agencies to patch CVE-2026-73570 in Zimbra Collaboration Suite within three days after the flaw was actively exploited, enabling unauthenticated remote code execution via a SNMP command-injection vulnerability when SNMP notifications are enabled. Zimbra patched the vulnerability in version 10.1.20 (July 20). CERT Polska flagged exploitation in the wild; Shadowserver reports thousands of exposed Zimbra servers and hundreds of compromised instances. Authorities urge checking logs for suspicious activity and for files created by the zimbra user in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps, and /tmp over the past month. Given ZCS’s widespread use, governments and businesses remain at risk, with past campaigns tied to APT groups exploiting Zimbra flaws.
- CISA orders urgent patching of actively exploited Zimbra flaw BleepingComputer
- Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution The Hacker News
- Hackers Target Zimbra Servers in Active Exploitation Campaign SecurityWeek
- High-Severity Vulnerability in Zimbra Collaboration Suite Cyber Security Agency of Singapore
- Actively Exploited Zimbra Flaw Lets Unauthenticated Attackers Execute Shell Commands cyberpress.org
Reading Insights
0
9
3 min
vs 4 min read
85%
731 → 109 words
Want the full story? Read the original article
Read on BleepingComputer