Full research report
Hackers breached over 270 Zimbra servers in ongoing attacks
Executive assessment
CVE-2026-73570 is a command injection flaw in Zimbra's optional SNMP monitoring component (zimbra-snmp/swatchdog), exploitable without authentication when SNMP notifications are enabled — a non-default but not uncommon configuration in enterprise and government deployments. Synacor released the fix on 20 July 2026, but a roughly 28-day window elapsed before exploitation was confirmed in the wild, by which point at least 274 internet-facing Zimbra instances had already been compromised per Shadowserver scanning on 22 August. The attack chain is well-documented: attackers deploy JSP web shells to the Zimbra Jetty web application directory and use HTTP access to enumerate mailboxes, harvest LDAP credentials, and move laterally. No specific threat actor has been attributed to the current campaign, though Zimbra's established history as a target for state-sponsored groups — including APT28 and Laundry Bear in prior campaigns — makes the platform high-value in espionage contexts. With 8,200 unpatched internet-facing instances identified and a working exploit confirmed in adversary hands, organisations running ZCS prior to 10.1.20 should treat this as an emergency patch alongside a concurrent 30-day retrospective compromise assessment.
What happened
A command injection vulnerability (CVE-2026-73570, CVSS 8.9) in the Zimbra Collaboration Suite SNMP monitoring component was patched by Synacor on 20 July 2026 in version 10.1.20. Approximately 28 days later, CERT Polska confirmed active exploitation in the wild, prompting CISA to add the flaw to its Known Exploited Vulnerabilities catalogue on 21 August 2026 with a three-day remediation deadline for US federal civilian agencies. By 22 August, Shadowserver's internet-wide scanning had identified at least 274 compromised instances, with the count fluctuating to 267 by 24 August, reflecting ongoing churn in the attack campaign.
Affected scope
Zimbra Collaboration Suite versions prior to 10.1.20 where the optional zimbra-snmp package is installed and SNMP notifications are enabled — a non-default configuration. Shadowserver identified over 8,200 unpatched internet-facing ZCS instances as of 22 August 2026, though not all are exploitable given the non-default SNMP requirement. ZCS is used by hundreds of millions of users across thousands of businesses and hundreds of government agencies worldwide.
Technical assessment
The flaw (CWE-78) resides in the SNMP notification processing path of the swatchdog service, bundled with the optional zimbra-snmp package. Unsanitised input supplied to this component allows injection of shell metacharacters, resulting in arbitrary OS command execution as the zimbra service account without any authentication. Observed post-exploitation follows a documented pattern: attackers write JSP web shells to the Zimbra Jetty web application directory, access them over HTTP to spawn child processes, enumerate mailboxes, harvest credentials from LDAP, and move laterally within the network.
Recommended defensive actions
- Upgrade Zimbra Collaboration Suite to version 10.1.20 or later immediately.
- Audit all Zimbra hosts for compromise before and after patching by hunting for JSP and JSPX files created in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ by the zimbra user within the last 30 days.
- Disable SNMP notifications (set snmp_notify to false) or remove the zimbra-snmp package on any host where SNMP monitoring is not operationally required, as an interim mitigation where immediate upgrade is not possible.
- Monitor for unexpected Zimbra service restarts in /var/log/zimbra.log and for anomalous child processes (shells, curl, wget, netcat, interpreters) spawned from the Zimbra JVM process tree.
- Restrict administrative console access (TCP 7071) to trusted networks and deploy WAF or reverse proxy inspection for internet-facing Zimbra endpoints.
Uncertainties and evidence gaps
- No specific threat actor or group has been attributed to the current exploitation campaign; attribution remains open.
- The exact compromised-instance count is a moving figure; Shadowserver reported 274 on 22 August and 267 on 24 August, indicating ongoing activity rather than a static event.
- No Zimbra or Synacor official security advisory URL was independently verifiable at time of writing; the patch version (10.1.20) is confirmed through multiple secondary sources.
- Whether post-exploitation objectives in the current campaign extend beyond web shell placement to sustained access, data exfiltration, or espionage is not yet documented.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Confirmed active exploitation in the wild; at least 274 Zimbra instances found compromised as of 22 August 2026 per Shadowserver internet-wide scanning; CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 21 August 2026; no public proof-of-concept broadly circulated at time of writing, though working exploit code is confirmed in adversary hands.
Research began by verifying the BleepingComputer report's core claims against independent technical sources and separate news outlets. Parallel searches confirmed the vulnerability mechanism, CISA KEV addition, and Shadowserver's compromise count across at least four independent domains. The CISA KEV alert page returned HTTP 403 and could not be cited directly; however, the KEV addition is corroborated by four separately verified sources. The Security Arsenal analysis provided the most detailed technical write-up, including detection rules and a documented post-exploitation pattern, confirming the investigation's central finding: this is a confirmed, actively exploited vulnerability with a well-understood attack chain, a 28-day patch-to-exploitation window, and no publicly available proof-of-concept at the time of research.
- What are the confirmed facts in the BleepingComputer report about Zimbra compromises?Fetched the primary BleepingComputer article to extract CVE details, exploitation statistics, and official agency actions.bleepingcomputer.com ↗
CVE-2026-73570 is a CVSS 8.9 command injection in the Zimbra SNMP component; patch released 20 July 2026; 274 instances compromised per Shadowserver as of 22 August; CERT Polska and CISA both confirmed active exploitation.
why Establishes the baseline event, timeline, and scale before independent corroboration.
- What technical details and independent sources confirm the vulnerability mechanism and scope?Searched for CVE-2026-73570 across security outlets to gather technical detail and corroborating coverage.
Multiple independent outlets confirm the SNMP command injection mechanism, CVSS 8.9, affected component (swatchdog/zimbra-snmp), and patch version 10.1.20; first disclosed 26 June 2026.
why Breadth of consistent independent coverage confirms the technical details are reliable and not artefacts of single-source reporting.
- Is the CISA KEV addition and Shadowserver compromise count independently corroborated?Searched for CISA KEV entry and Shadowserver data to verify against additional independent sources.
CISA KEV addition on 21 August and Shadowserver's 274-instance count confirmed across The Hacker News, SecurityWeek, SC Media, and Security Affairs; FCEB three-day remediation deadline (24 August) corroborated.
why Multi-source corroboration of both the government action and the scanning data establishes exploitation at scale as a confirmed fact.
- What does The Hacker News independently report about the exploitation timeline and geographic spread?Fetched the The Hacker News article for independent corroboration.thehackernews.com ↗
Corroborates CVSS 8.9, patch date, CERT Polska timing, CISA KEV addition, and Shadowserver count; adds geographic breakdown (US 46, Sweden 21, France 20, Germany 17) and notes compromise count fluctuated between 267 and 274.
why Independent outlet validates primary facts and adds operational granularity on geographic distribution relevant to scope assessment.
- Can the CISA KEV alert page be directly verified?Attempted to fetch the CISA KEV alert page directly.cisa.gov ↗
HTTP 403 Forbidden; page content not retrievable.
why CISA's KEV addition cannot be cited from a direct page fetch; however, it is corroborated by four separately verified sources, maintaining high confidence in this fact.
- What are the precise CVSS score, affected versions, and formal vulnerability classification?Fetched the Tenable CVE database entry for CVE-2026-73570.tenable.com ↗
CVSS v3 8.9 (High), CVSS v2 7.3; affects ZCS before 10.1.20 when zimbra-snmp is installed and SNMP notifications are enabled; confirmed active exploitation noted.
why Tenable's structured vulnerability data provides authoritative technical classification independent of news reporting.
- How did the compromise count evolve and what additional threat actor details are available?Fetched the Help Net Security article to track compromise escalation and identify any attribution.helpnetsecurity.com ↗
Shadowserver detected 155 compromised instances on 20 August escalating to 274 by 22 August; threat actor attribution remains unknown; both SNMP notification disable and upgrade to 10.1.20 cited as mitigations.
why The escalating compromise count and absent attribution are material to the assessment's urgency and key-entities sections.
- Does Security Affairs add corroborating detail on the CISA KEV timeline and the patch-to-exploitation window?Fetched the Security Affairs article on the CISA KEV addition.securityaffairs.com ↗
Confirms approximately 28-day window between patch release (20 July) and first confirmed exploitation (~18 August); corroborates CERT Polska advisory and CISA's three-day remediation mandate.
why The 28-day patch-to-exploitation gap is operationally significant for organisations assessing exposure window and remediation urgency.
- What post-exploitation behaviour, detection rules, and IOCs are documented for this vulnerability?Fetched the Security Arsenal technical analysis for post-exploitation patterns, detection artefacts, and PoC status.securityarsenal.com ↗
Documented attack chain: crafted requests → JSP web shell written to Jetty webroot → HTTP access to spawn child processes → mailbox enumeration, LDAP credential harvest, lateral movement. Sigma rules target JSP file creation, anomalous child processes, and uncommon HTTP requests. Working exploit confirmed in adversary hands; no broadly public PoC.
why Provides defender-actionable IOCs and confirms the attack chain is well understood, directly informing detection and defensive-action sections.
Research coverage
All 67 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 55 completed sources contained no matched information for this story.
Complete source-by-source audit 67 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok10 records | Primary evidence2 matched items | Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research. |
| CISA KEVkev | ok1676 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok7970 records | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5332 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok687 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1012 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1591 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 5 opened outside the registered collection
Vulnerability & exploitation2
PoC & exploit code1
Technical write-up with Sigma rules, KQL queries, and documented post-exploitation IOCs; confirms working exploit in adversary hands but no public PoC.
Vendor & gov advisories1
CVSS 8.9 (High); confirms affected versions, patch release, and active exploitation status.
Analysis & research4
Primary reporting citing Shadowserver's 274 compromised instances, CERT Polska detection guidance, and CISA remediation mandate.
Independent corroboration of exploitation timeline, attack chain, and geographic distribution of compromised instances.
Documents escalation from 155 compromised instances on 20 August to 274 by 22 August; confirms unknown threat actor attribution.
Confirms 28-day gap between patch release and first confirmed exploitation, and three-day FCEB remediation deadline.