GoKawiilCERT Polska, the Polish Computer Emergency Response Team (CERT), warned that attackers have begun exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS).
ZCS is a popular email and collaboration software suite used by hundreds of millions of people and organizations worldwide, including thousands of businesses and hundreds of government agencies.
The Zimbra security team released version 10.1.20 on July 20 to patch the vulnerability (tracked as CVE-2026-73570), which allows unauthenticated attackers to gain remote code execution by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled.
"Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user," it explained.
Internet security watchdog Shadowserver now tracks over 12,100 Zimbra servers exposed online, most of them in Europe (4,382) and Asia (4,492).
However, there is no information on how many of them are honeypots or have already been patched against the CVE-2026-73570 security flaw.
Internet-exposed Zimbra servers (Shadowserver)
Flagged as actively exploited
On Monday, the Polish CERT team reported that threat actors are now exploiting CVE-2026-73570 in attacks.
"The CERT Polska team reports on an actively used OS Command Injection vulnerability in the Zimbra Collaboration Suite," it warned.
... continue reading