Zimbra Under Attack: Command Injection Exploited in the Wild, CISA Mandates Patch

A Critical Flaw Enters the KEV Catalog with Immediate Deadline

On August 21, CISA added CVE-2026-73570 to the Known Exploited Vulnerabilities (KEV) catalog. It is a command injection vulnerability in the SNMP notification management component of Zimbra Collaboration Suite (ZCS). The deadline for U.S. federal agencies is three days later: August 24.

The CVE was published by NVD on August 13 and last modified on August 24. The CVSS v3.1 score assigned by the CNA MITRE is 8.9, rated HIGH. The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L: network-exploitable, no privileges or user interaction required, high impact on confidentiality and integrity, and limited impact on availability.

Affected versions are all those prior to 10.1.20. The fix was released on July 20 with version 10.1.20. Anyone using older releases and exposing ZCS to the internet must update immediately.

How the Exploit Works: SMTP Requests Against SNMP Notifications

The vulnerability stems from insufficient sanitization of untrusted input during SNMP notification processing. An unauthenticated attacker can send specially crafted SMTP requests to achieve arbitrary OS command execution with the privileges of the zimbra user.

Two conditions are required for the attack to succeed. The optional zimbra-snmp package must be installed and SNMP notifications must be enabled. If either condition is missing, the flaw is not exploitable. No official workaround alternative to the patch has surfaced; the recommended mitigation is to update to the fixed version.

The associated CWE is CWE-78, "Improper Neutralization of Special Elements used in an OS Command." The CVSS 8.9 score comes from the CNA MITRE. NVD has not yet provided its own assessment for versions 4.0, 3.x, and 2.0. The CISA ADP also updated the exploitation field from none to active on August 21, confirming active exploitation.

Exposure and Compromises: 12,000 Servers Online, 270 Already Hit

According to BleepingComputer, the in-the-wild exploitation was first reported by CERT Polska last week. CISA then confirmed it and added the CVE to KEV.

Shadowserver is monitoring more than 12,000 internet-exposed Zimbra servers. Last week it stated that it had identified over 270 compromised Zimbra Collaboration Suite instances, searching for artifacts of CVE-2026-73570 exploitation. It is not known how many of these servers are honeypots or were already secured before detection.

CISA has not released details about the ongoing attacks. No named attribution for the current exploitation currently exists. The lack of public information does not reduce the severity: presence in KEV indicates the flaw is already being used by real attackers.

Zimbra in the Crosshairs of State Groups: A Recent History

Zimbra Collaboration Suite is a widely used email and collaboration platform. According to BleepingComputer, it is used by hundreds of millions of organizations and people, including hundreds of government agencies and thousands of companies. Because of this widespread adoption, its mail servers are a recurring target for cyber espionage.

In recent years, several Zimbra vulnerabilities have been exploited in the wild to steal sensitive data. According to Seqrite Labs researchers, the Russian state group APT28 reportedly exploited a stored XSS in March against ZCS servers of Ukrainian government agencies. The year of the incident was not specified by the sources, but BleepingComputer reports it as a recent fact.

In October 2024, U.S. and U.K. cyber agencies warned that APT29, also known as Midnight Blizzard or Cozy Bear, was targeting Zimbra servers using an already exploited flaw to steal email credentials. The Russian cyberspionage group Winter Vivern has also abused a reflected XSS in the past to exfiltrate emails from NATO-aligned individuals and organizations via Zimbra webmail portals.

The new command injection thus fits into a series of targeted attacks against ZCS, often conducted by state or state-aligned actors.

What to Do: Patch, Forensic Checks, and Indicators of Compromise

The first action is to update Zimbra Collaboration Suite to version 10.1.20 or later. The patch has been available since July 20. For cloud services, CISA requires following Binding Operational Directive BOD 26-04 or discontinuing use of the product if mitigations are not available.

BOD 26-04 requires U.S. federal agencies to prioritize remediation of high-risk vulnerabilities in the KEV, especially on publicly exposed assets that, after exploitation, grant full control of the asset. The directive also establishes when agencies must verify whether attackers compromised the system before the patch was applied. CISA requires performing the checks set out in the "Forensics Triage Requirements" to identify any prior compromises.

CERT Polska has asked security teams to check logs for suspicious activity. Indicators to look for include unexpected restarts of the Zimbra service and the creation of files by the zimbra user in the following folders within the last 30 days:

• /opt/zimbra/jetty/webapps/
• /opt/zimbra/jetty_base/webapps/
• /tmp/

The presence of suspicious files in these directories may indicate that an attacker has already uploaded a webshell or other artifacts. In that case, the patch alone is not enough: a full forensic analysis is needed to rule out persistence and lateral movement.

For non-federal organizations, BOD 26-04 is not binding, but CISA encourages all entities to adopt risk-based vulnerability management and to prioritize remediation of CVEs listed in the KEV. The August 24 deadline applies only to U.S. FCEB agencies, but the presence of active exploits makes the update urgent for anyone exposing Zimbra to the internet.