Reported by 14 outlets

Timeline

1. original reporting

   Critical Zimbra RCE flaw now actively exploited in attacks

   bleepingcomputer.com · 54d ago · August 20th, 2026

   CERT Polska, the Polish Computer Emergency Response Team (CERT), warned that attackers have begun exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS). ZCS is a popular email and collaboration software suite used by hundreds of millions of people and organizations worldwide, including thousands of businesses and hundreds of government agencies. The Zimbra security team released version 10.1.20 on July 20 to patch the vulnerability (tracked as CVE-2026-73570 ), which allows unauthenticated attackers to gain remote code execution by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled. "Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user," it explained. Internet security watchdog Shadowserver now tracks over 12,100 Zimbra servers exposed online, most of them in Europe (4,382) and Asia (4,492). However, there is no information on how many of them are honeypots or have already been patched against the CVE-2026-73570 security flaw. Internet-exposed Zimbra servers (Shadowserver) ​Flagged as actively exploited On Monday, the Polish CERT team reported that threat actors are now exploiting CVE-2026-73570 in attacks. "The CERT Polska team reports on an actively used OS Command Injection vulnerability in the Zimbra Collaboratio

2. update from web.archive.org

   Zimbra Security Advisories wiki carried no CVE-2026-73570 entry before the 10.1.20 patch (Wayback capture, 9 July 2026)

   web.archive.org · 96d ago · July 9th, 2026

   An archived copy of Zimbra's public Security Advisories table, captured 2026-07-09 19:46 UTC, lists no SNMP command injection entry and no 10.1.20 release; the newest rows are the 10.1.19 Classic Web Client XSS fix (released 7 July) and the 10.1.18 DoS fix (released 16 June). Synacor had disclosed the SNMP vulnerability in a security advisory on 26 June 2026, as its own 20 July patch post states, so that advisory never reached the public advisories wiki before the fix shipped. In the live table the CVE-2026-73570 row still carries no reporter credit and a TBD CVSS score, and the July 20 blog notes information disclosure is deliberately limited for security fixes.

3. update from blog.zimbra.com

   Patch Release Update: Zimbra 10.1.20

   blog.zimbra.com · 86d ago · July 20th, 2026

   Synacor released ZCS 10.1.20 with a permanent fix for a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled, rated High severity with Low deployment risk. The same release also fixed several Classic Web Client stored XSS issues and a mail forwarding restriction bypass.

4. update from

   Zimbra Collaboration Suite 10.1.20 — Critical Command Injection + XSS + SSRF

   · 85d ago · July 21st, 2026

   Four XSS flaws in the Classic Web Client, a mail forwarding restriction bypass (CVE-2026-50055), an EWS extension access control bug (CVE-2026-10631), a mailbox delegation authorization issue (CVE-2026-50054), and an SSRF in the Nextcloud integration are also fixed. No exploitation reported, but Zimbra is a high-value target for email-oriented threat actors. Action: Update to ZCS 10.1.20 immediately. Disable SNMP notifications if not required. Sources: SecurityWeek

5. mentioned by nvd.nist.gov

   CVE-2026-73570 Detail (NVD)

   nvd.nist.gov · 61d ago · August 13th, 2026

6. update from cyberpress.org

   Critical Zimbra OS Command Injection Vulnerability Exploited in the Wild

   cyberpress.org · 54d ago · August 20th, 2026

   A critical command-injection flaw in Zimbra Collaboration Suite is being actively exploited, prompting administrators to urgently patch installations and review systems for compromise. CERT Polska issued Alert 145/2026 on August 17, warning that CVE-2026-73570 enables unauthenticated remote attackers to run arbitrary operating-system commands as the zimbra user. It affects deployments where SNMP trap notifications have been enabled through the snmp_notify parameter and the swatchdog service is running. Critical Zimbra OS Command Injection Vulnerability Swatchdog is enabled by default, making configuration review especially important for organizations that have installed and activated the optional zimbra-snmp functionality. An attacker can deliver specially crafted SMTP requests that lead to arbitrary command execution under the zimbra account, without first authenticating to the server. The weakness is categorized as CWE-78, Improper Neutralization of Special Elements used in an OS Command. That account normally has access to mail-related data, application directories, configuration material, and service processes. A successful intrusion could enable mailbox theft, web shell deployment, credential harvesting, lateral movement staging, or persistence within the Zimbra environment. Defen

7. update from gbhackers.com

   Zimbra RCE Vulnerability Lets Remote Attackers Execute System Commands

   gbhackers.com · 54d ago · August 20th, 2026

   Zimbra RCE Vulnerability The flaw affects Zimbra […] The post Zimbra RCE Vulnerability Lets Remote Attackers Execute System Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

8. update from securityweek.com

   Hackers Target Zimbra Servers in Active Exploitation Campaign

   securityweek.com · 54d ago · August 20th, 2026

   Virtual Event Today: CodeSecCon - Learn to Secure Your Software > Join Event

9. update from cisa.gov

   CISA Known Exploited Vulnerabilities Catalog: CVE-2026-73570

   cisa.gov · 54d ago · August 21st, 2026

   The entry requires forensic triage of potentially affected systems; ransomware campaign use is listed as Unknown.

10. update from cyberpress.org

    Actively Exploited Zimbra Flaw Lets Unauthenticated Attackers Execute Shell Commands

    cyberpress.org · 50d ago · August 24th, 2026

    CERT Polska urged administrators to immediately verify the version deployed in their environments and update all affected systems to the fixed release. The urgency is heightened by the confirmation that attackers are already exploiting the vulnerability in ongoing campaigns. Successful exploitation of CVE-2026-73570 does not require an attacker to possess valid Zimbra credentials. This makes vulnerable, internet-accessible mail servers particularly attractive targets, as attackers could potentially gain a foothold through a single crafted request or interaction with the affected service functionality. While this does not inherently provide root-level access, the account commonly has broad access to Zimbra application files, mail-related

11. update from bleepingcomputer.com

    CISA orders urgent patching of actively exploited Zimbra flaw

    bleepingcomputer.com · 50d ago · August 24th, 2026

    The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to secure their systems within three days, by August 24. Although CISA didn't share a

12. mentioned by gbhackers.com

    Zimbra Collaboration Suite Flaw Actively Exploited to Execute Arbitrary Commands

    gbhackers.com · 50d ago · August 24th, 2026

13. update from bleepingcomputer.com

    Hackers breached over 270 Zimbra servers in ongoing attacks

    bleepingcomputer.com · 49d ago · August 25th, 2026

    CERT Polska, the Polish Computer Emergency Response Team (CERT), first flagged the vulnerability as targeted in the wild last Monday, when it also warned security teams to check their logs for suspicious activity, including the Zimbra service restarting unexpectedly, and for files created in the /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ folders by user zimbra over the last 30 days.

14. update from habr.com

    Your Zimbra server is under threat: PT ESC IR team encountered new ransomware attack on Zimbra mail servers using CVE-2026-73570

    habr.com · 27d ago · September 16th, 2026

    Recently our PT ESC IR team encountered a new ransomware group attack on Zimbra mail servers using vulnerability CVE-2026-73570 and the TargetZimbra encryptor. According to open sources, similar attacks have been massively recorded on Zimbra servers since mid-August. Disclaimer: if you are using an outdated version of Zimbra software and have not detected the indicators of compromise of the specific TargetZimbra ransomware campaign on your mail server, this does not mean your server is guaranteed not compromised. CVE-2026-73570 can be used by other attackers, for example, to install miners, as well as APT groups targeting compromise of the entire organization's infrastructure.

    CVE-2026-73570 allows an attacker to inject and execute malicious commands on the Zimbra mail server with zimbra user privileges without prior authentication due to insufficient input sanitization in the SNMP component. The vulnerability is exploited by sending a specially crafted SMTP request through ports 25, 465, or 587. Attack scenario:

    1. At the next stage, attackers upload JSP shells to the mail server directory /opt/zimbra/jetty_base/webapps/zimbra/public/. Additionally, the hacking tool Gsocket was recorded being injected onto the server. After launch, the malicious module encrypts files using the ChaCha20 algorithm in the /opt/zimbra/ directory and its subdirectories. After file encryption, the encryptor changes their extension to .elock and creates files !README_RECOVER.txt in encrypted directories containing contact information and ransom payment details. Upon completion, the TargetZimbra malicious module deletes itself from the system. In the main system log of the mail service /var/log/maillog, records containing the substring changed from stopped to, preceded by a shell command or other suspicious payload, are indicators of CVE-2026-73570 exploitation. Characteristic features of malicious JSP files include obfuscated code, encoded strings, and atypical handling of GET and POST requests. Search commands: find /opt/zimbra/jetty_base/webapps/zimbra/ -type f -iname '*.jsp' -newermt '2026-07-01' (search by file modification date) find /opt/zimbra/jetty_base/webapps/zimbra/ -type f -iname '*.jsp' -newerBt '2026-07-01' (search by file creation date)

    Note: not all Linux file systems store file creation date. Recommendations:

    1. If immediate software update is not possible, a temporary solution may be disabling SNMP notifications and removing the zimbra-snmp package. Additionally, check the mail server with antivirus tools and manually inspect non-standard JSP files created in recent months in Zimbra service directories. Indicators of Compromise:

    File indicators: - /opt/zimbra/jetty_base/webapps/zimbra/public/version.txt or versions.txt - file containing Zimbra software version - /opt/zimbra/jetty_base/webapps/zimbra/public/[Filename].jsp - web shell - /opt/zimbra/log/defunct - Gsocket - elockc[a-z] (e.g., elockcl) - encryptor - runloop.sh - script created by encryptor - !README_RECOVER.txt - attacker's note - *.elock - files with .elock extension

    Network indicators: 135.136.63.63 139.28.49.138 146.70.169.246 193.24.211.91 193.32.126.168 31.177.110.136 37.32.73.156 64.62.156.162 64.62.156.222 64.62.156.94 88.214.21.183 89.116.171.182 89.117.94.35

    Gsocket indicators: *.gs.thc.org gsocket.io 152.53.173.29 152.53.173.30 176.65.149.52 212.132.98.170 217.154.53.116 217.154.53.187 45.90.4.121 45.90.4.128 51.91.190.241 51.91.190.242

    via Mastodon https://habr.com/ru/companies/pt/articles/1082654/

15. update from hookprobe.com

    🎬 How HookProbe Detects CVE-2026-73570 (Synacor Zimbra Collaboration Suite (ZCS)) — AI-native edge security on a $50 Raspberry Pi. # infosec

    hookprobe.com · 21d ago · September 22nd, 2026

    🎬 How HookProbe Detects CVE-2026-73570 (Synacor Zimbra Collaboration Suite (ZCS)) — AI-native edge security on a $50 Raspberry Pi.

16. update from microsoft.com

    Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

    microsoft.com · 13d ago · September 30th, 2026

    In this article Attack chain overview Mitigation and protection guidance References Learn More Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570 , an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. Following successful exploitation, observed activity included deployment of JSP web shells and reverse shells, privilege escalation, persistent remote-access tooling, and memory-backed execution. The activity included both automated payload delivery and hands-on-keyboard operations on compromised mail servers. Microsoft observed affected organizations in more than one region and industry. Based on the environments investigated, exploitation was not limited to a single sector or geographic area. The diagram combines behaviors observed across multiple confirmed compromises; no single host necessarily exhibited every stage.

17. update from securityonline.info

    Zimbra CVE-2026-73570 lets one crafted email run code. Microsoft details the Zimbra command injection attacks: web shells, root access, and

    securityonline.info · 13d ago · September 30th, 2026

    Microsoft details the Zimbra command injection attacks: web shells, root access, and

    via Mastodon https://securityonline.info/zimbra-cve-2026-73570-2/?utm_source=mastodon&utm_medium=jetpack_social

18. mentioned by www.microsoft.com

    New. Microsoft: Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 https://www. microsoft.com/en-us/

    www.microsoft.com · 13d ago · September 30th, 2026

19. mentioned by thehackernews.com

    🤖 CVE-2026-73570 (CVSS 8.9): unauthenticated OS command injection in Zimbra Collaboration Suite, exploited in the wild to deploy web shells

    thehackernews.com · 13d ago · September 30th, 2026

20. update from thehackernews.com

    Attackers exploit Zimbra flaw to deploy web shells and harvest authentication secrets

    thehackernews.com · 13d ago · September 30th, 2026

    Attackers exploit Zimbra flaw to deploy web shells and harvest authentication secrets.

21. mentioned by arstechnica.com

    Attackers have been exploiting critical Zimbra flaw to steal emails https://arstechnica.com/security/2026/09/attackers-have-been-exploiting-

    arstechnica.com · 13d ago · September 30th, 2026

22. mentioned by www.microsoft.com

    (microsoft.com) Exploitation of CVE-2026-73570: Unauthenticated OS Command Injection in Zimbra Collaboration Suite In brief - This article d

    www.microsoft.com · 13d ago · October 1st, 2026