Attack on Zimbra: Over 270 Servers Breached Through an SNMP Vulnerability

The wave of attacks on the Zimbra Collaboration Suite (ZCS) mail and collaboration package continues: attackers have already compromised more than 270 instances by exploiting a serious remote code execution vulnerability. ZCS is used by hundreds of millions of people and organizations, including thousands of companies and hundreds of government agencies around the world.

The nature of the vulnerability

The flaw, assigned the identifier CVE-2026-73570, involves command injection in the SNMP monitoring component and is triggered when SNMP notifications are enabled. It allows an unauthenticated attacker to remotely execute arbitrary code. Synacor fixed the issue on July 20 with the release of ZCS version 10.1.20.

Timeline of the attacks

Poland's CERT Polska response team was the first to report targeted exploitation of the vulnerability and advised specialists to check their logs for suspicious activity: unexpected restarts of the Zimbra service and the appearance of files created by the zimbra user over the past 30 days in the /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/ and /tmp/ directories.

Following the warning, the U.S. agency CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and ordered U.S. federal civilian agencies to install the update within three days — by August 24.

Threat monitoring service Shadowserver reported that it had recorded hundreds of internet-facing Zimbra servers already breached through CVE-2026-73570. According to its data, 274 compromised instances had been detected as of August 22. In addition, analysts see at least 8,200 unpatched systems, though this does not automatically mean they are vulnerable — the flaw only manifests in a non-standard configuration.

A familiar target

Zimbra has long remained a favorite target of both cybercriminals and state-sponsored groups: the servers are regularly attacked in order to steal emails containing sensitive data. For instance, in March researchers at Seqrite Labs recorded how hackers from Russian military intelligence APT28 used a stored XSS vulnerability to breach servers belonging to the Ukrainian government. In October 2024, U.S. and U.K. cyber oversight agencies warned of the compromise of Zimbra servers by the APT29 group (Midnight Blizzard, Cozy Bear), which is linked to Russia's SVR. Another group, Winter Vivern, exploited a reflected XSS vulnerability to steal emails from mail accounts associated with NATO.

Administrators using Zimbra are strongly urged to move to the current version as soon as possible and to check their systems for signs of compromise.

Source: Bleeping Computer