Full research report
CISA orders urgent patching of actively exploited Zimbra flaw
Executive assessment
CVE-2026-73570 is a high-severity, unauthenticated remote code execution path in Zimbra Collaboration Suite that exploits insufficient input sanitisation in the optional SNMP monitoring component, affecting only servers where zimbra-snmp is installed and SNMP notifications are active. The 28-day gap between the 20 July patch and confirmed exploitation is consistent with the typical latency observed in prior Zimbra-targeting campaigns, where attackers reverse-engineer patches before broad organisational deployment. Exploitation is definitively confirmed by CERT Polska, CISA's KEV addition, and Shadowserver's identification of over 270 compromised hosts; however, the absence of any public proof-of-concept and the AC:H CVSS vector indicate that a working exploit is currently privately held rather than widely distributed. No threat actor has been attributed, but Zimbra's established history as a target for Russian and Chinese state-sponsored groups, as well as opportunistic cybercriminals, means the attacker profile remains genuinely open. Defenders should treat any unpatched ZCS instance with zimbra-snmp enabled as potentially compromised pending forensic review.
What happened
CVE-2026-73570 is an unauthenticated remote code execution vulnerability in Zimbra Collaboration Suite (ZCS) caused by OS command injection in the optional SNMP monitoring component. Zimbra issued a patch in version 10.1.20 on 20 July 2026; active exploitation was confirmed by CERT Polska on 20 August, leaving a roughly 28-day window between patch release and in-the-wild attacks. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 21 August and ordered US Federal Civilian Executive Branch (FCEB) agencies to remediate by 24 August 2026. Shadowserver observed over 270 compromised ZCS instances and approximately 12,000 internet-exposed Zimbra servers.
Affected scope
Zimbra Collaboration Suite (ZCS) versions prior to 10.1.20 where the optional zimbra-snmp package is installed and SNMP trap notifications are enabled. Affected organisations include government agencies, enterprises, and managed email providers globally; ZCS is used by hundreds of government bodies and thousands of businesses worldwide.
Technical assessment
The weakness (CWE-78, OS Command Injection) resides in the SNMP notification processing code of the optional zimbra-snmp package. Insufficient sanitisation of untrusted input allows an unauthenticated network attacker to pass crafted SMTP data that reaches an OS command execution path, resulting in arbitrary command execution under the Zimbra service account. The CVSS 3.1 score is 8.9 (High; vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L); the AC:H element reflects the configuration prerequisite — specifically that the zimbra-snmp package must be installed and SNMP notifications enabled — which narrows the exposed population but does not prevent exploitation where those conditions are met.
Recommended defensive actions
- Patch Zimbra Collaboration Suite to version 10.1.20 or later immediately; this is the only complete remediation.
- Disable or remove the zimbra-snmp package on all servers where SNMP monitoring is not operationally required, eliminating the vulnerable attack surface.
- Hunt for compromise indicators: inspect /var/log/zimbra.log for unexpected Zimbra service restarts, and check /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ for files created by the zimbra user within the past 30 days.
- Inventory all internet-exposed Zimbra instances and validate patch status; reference Shadowserver's exposure data to identify unpatched assets.
- Monitor network traffic for anomalous SMTP activity targeting SNMP processing paths and alert on unexpected outbound connections originating from the Zimbra process.
Uncertainties and evidence gaps
- No specific threat actor or group has been attributed to the active exploitation campaign; motivation — whether espionage, ransomware staging, or opportunistic access — is unknown.
- The precise proportion of the ~12,000 internet-exposed Zimbra servers that have the zimbra-snmp package installed with SNMP notifications enabled is not publicly quantified, making total exposure difficult to assess.
- No public proof-of-concept code has been confirmed; it is unclear whether the 270+ compromises reflect a single coordinated campaign or multiple independent actors using a privately held exploit.
- The CISA advisory page returned HTTP 403 and could not be directly verified; KEV addition is corroborated by multiple independent outlets but the primary government source text could not be retrieved.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Confirmed active exploitation in the wild from at least 20 August 2026; CISA added to KEV catalogue on 21 August 2026; Shadowserver identified over 270 compromised Zimbra Collaboration Suite instances as of 23 August; no public proof-of-concept code confirmed.
Research began with the BleepingComputer article and CISA KEV record as primary leads, then expanded to SecurityWeek, The Hacker News, Tenable, and the GitHub Advisory Database to obtain independent technical corroboration and scoring data. CERT Polska's role as the first alerting body and Shadowserver's compromise count were consistent across all sources consulted. No public proof-of-concept code was identified, and no threat actor attribution was confirmed despite targeted searching, leaving those dimensions as confirmed unknowns rather than omissions.
- What does the primary reporting establish about CVE-2026-73570?Fetched the BleepingComputer article via WebFetchbleepingcomputer.com ↗
Confirmed unauthenticated RCE via SNMP command injection in ZCS; patch released 20 July 2026 in version 10.1.20; CERT Polska confirmed exploitation; Shadowserver found 270+ compromised instances across ~12,000 exposed servers; CISA KEV added 21 August with 24 August federal deadline.
why Established the core timeline, technical claims, and scope before seeking independent corroboration.
- What independent coverage and search results exist for CVE-2026-73570?Ran web search for CVE-2026-73570 CISA KEV 2026
Multiple independent outlets — SecurityWeek, The Hacker News, Security Affairs, Tenable, GitHub Advisory Database — cover the same event with consistent technical detail; no standalone PoC repositories returned in results.
why Confirmed wide corroboration and that no public exploit code appeared in search results, strengthening the credibility of the reported facts.
- What does the CISA advisory say directly?Attempted to fetch CISA KEV alert page via WebFetchcisa.gov ↗
HTTP 403 returned; page content could not be retrieved.
why CISA's primary advisory is unverifiable via direct fetch; KEV addition is instead confirmed through multiple corroborating secondary sources, which is sufficient for this assessment.
- Does SecurityWeek independently confirm exploitation and clarify attribution?Fetched SecurityWeek article via WebFetchsecurityweek.com ↗
Independently confirms CERT Polska exploitation alert; explicitly states threat actor identity is unknown; notes 28-day gap from patch to confirmed attacks; confirms zimbra-snmp package and SNMP notifications are required conditions.
why Provides independent corroboration and authoritatively clarifies that attribution is genuinely unresolved, not merely unreported, which is a material assessment point.
- What are the precise CVSS, EPSS and configuration details?Fetched Tenable CVE page for CVE-2026-73570tenable.com ↗
CVSS 3.1 score 8.9 (High); EPSS 0.00539; KEV status confirmed; patch is version 10.1.20; attack conditioned on optional zimbra-snmp package with SNMP notifications enabled.
why Provided authoritative scoring data; the conditional configuration requirement is important for defenders assessing their own exposure.
- Is any public proof-of-concept or exploit code available?Ran web search for CVE-2026-73570 proof-of-concept exploit GitHub 2026
GitHub Advisory Database entry GHSA-jqh7-pchh-v74j found; no standalone PoC repositories returned; CVSS vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L confirmed.
why AC:H indicates a configuration prerequisite, consistent with the zimbra-snmp requirement; no public PoC found lowers immediate mass-exploitation risk while not negating confirmed active attacks.
- Does the GitHub Advisory Database add PoC details or additional technical context?Fetched GitHub Advisory Database entry GHSA-jqh7-pchh-v74jgithub.com ↗
CVSS 8.9, CWE-78 confirmed; EPSS noted as 1.506% at 72nd percentile (more recent calculation than source material's 1.042% at 61st percentile); no PoC code referenced.
why Independently confirmed all key technical details; EPSS percentile variation across sources reflects different calculation dates and does not alter the exploitation status assessment.
Research coverage
All 67 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 67 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok9 records | Primary evidence2 matched items | Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research. |
| CISA KEVkev | ok1675 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5332 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok687 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1012 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok18 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 6 opened outside the registered collection
Vulnerability & exploitation2
Vendor & gov advisories1
CVSS 8.9, CWE-78; confirms no public PoC documented; independent CVSS vector cross-check
Analysis & research4
Primary reporting; includes CERT Polska IoCs, Shadowserver compromise count, and CISA remediation deadline
Independent corroboration; explicitly confirms threat actor attribution is unresolved
Detailed exploitation timeline; confirms CERT Polska IoC guidance and 28-day patch-to-exploitation window
Authoritative CVSS and EPSS scoring; confirms KEV status and conditional zimbra-snmp prerequisite