Unpatched Zimbra servers compromised via CVE-2026-73570

At least 274 internet-facing Zimbra instances have been compromised by unknown attackers exploiting CVE-2026-73570, according to the Shadowserver Foundation. The number of affected servers has been rising since 155 were flagged on August 20.

The vulnerability is a code injection flaw in Zimbra Collaboration Suite, patched in version 10.1.20 released on July 20, 2026. It affects mailservers with the optional zimbra-snmp package installed and SNMP notifications enabled, allowing unauthenticated attackers to execute arbitrary commands as the Zimbra user via crafted SMTP requests.

Polish CERT first flagged in-the-wild exploitation a week ago. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and ordered US federal civilian agencies to patch within three days and check for compromise. Shadowserver also noted at least 8,200 instances remain unpatched, though not all may be exploitable due to the non-default configuration requirement.