GoKawiilAttackers exploit Zimbra RCE flaw, compromise 274 servers worldwide
Shadowserver identified 274 Zimbra Collaboration Suite instances already breached through exploitation of CVE-2026-73570, a command injection flaw in the SNMP monitoring component that allows unauthenticated remote code execution. Synacor patched the bug in ZCS 10.1.20 on July 20, but Shadowserver still counts over 8,200 unpatched instances exposed online, though not all are necessarily exploitable due to non-default configuration requirements.
GoKawiil's interpretation of the reporting above, not reported fact.
Zimbra powers email and collaboration for hundreds of millions of users, including many government agencies, making it a recurring target for both criminal and state-backed hackers. CISA's rapid three-day patch mandate for federal agencies underscores how seriously the vulnerability is viewed, and the growing compromise count shows attackers are moving faster than many organizations can patch.
- 274 Zimbra servers confirmed compromised via CVE-2026-73570 exploitation as of August 22.
- The flaw requires SNMP notifications enabled, but over 8,200 unpatched instances remain exposed online.
- CISA ordered federal agencies to patch by August 24 after CERT Polska flagged active exploitation.
Yubico YubiKey 5 NFC Security Key — When mail and collaboration servers are getting popped, phishing-resistant hardware MFA is one of the few controls that keeps admin accounts from becoming the next foothold. The YubiKey 5 NFC plugs into USB-A or taps an NFC phone and works with FIDO2/WebAuthn, OTP and smart card logins across the tools sysadmins live in. It's a pocket-sized upgrade for anyone hardening access after headlines like this one.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-25
Published there as: “Hackers breached over 270 Zimbra servers in ongoing attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.