Hackers Target Zimbra Servers in Active Exploitation Campaign

A recently patched Zimbra Collaboration vulnerability is being exploited in the wild, according to Poland’s CERT Polska. The security hole is tracked as CVE-2026-73570 and it was patched by the developers of the enterprise email server and collaborative software suite with the release of version 10.1.20, announced on July 20. The high-severity flaw exists when the optional ‘zimbra-snmp’ package is installed and SNMP notifications are enabled. An attacker can exploit the vulnerability without authentication to execute arbitrary OS commands as the Zimbra user. The Polish CERT announced seeing attacks this week but did not share any details about the active exploitation campaign. It did, however, share some indicators of compromise (IoCs). The threat actor behind these attacks and its motivation remain unclear. However, these vulnerabilities can allow threat actors to gain full control of a targeted Zimbra server. The hackers can then establish persistence, access email accounts, harvest credentials, and move laterally to other systems. CISA’s KEV catalog currently includes 18 Zimbra Collaboration Suite vulnerabilities, including four added this year. CVE-2026-73570 has yet to be added to the catalog. Exploitation of Zimbra vulnerabilities has frequently been linked to Russian and Chinese state-sponsored hackers targeting military and diplomatic intelligence, as well as opportunistic cybercriminals seeking financial gain. Related: MLflow Vulnerability Exploited for Cloud Credential Theft Related: Critical GitLab Flaw Exploited Shortly After Disclosure Related: Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler