Hundreds of internet-facing Zimbra instances have been compromised through a vulnerability that was patched last month, researchers have warned.
The Zimbra Collaboration Suite (ZCS) hosts email, calendars, contacts, and administrative services. It has hundreds of millions of users, including thousands of businesses and hundreds of government agencies worldwide.
The security flaw, tracked as CVE-2026-73570 and rated high severity with a CVSS score of 8.9, allows unauthenticated attackers to execute malicious code remotely.
It works by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled, and affects Zimbra Collaboration's Simple Network Management Protocol (SNMP).
This is a monitoring functionality in deployments where the optional zimbra-snmp package is installed and SNMP notifications are enabled.
"This vulnerability could allow an unauthenticated attacker to send specially crafted SMTP requests, potentially resulting in the execution of arbitrary operating system commands as the Zimbra user when the optional zimbra-snmp package is installed and SNMP notifications are enabled," warned the Hong Hong Computer Emergency Response Team (HKCert) this week.
Hackers can then establish persistence, access email accounts, harvest credentials, and move laterally to other systems. Synacor, the company behind the collaboration suite, was first made aware of the issue in June, issued a temporary mitigation, and fixed it with the release of ZCS version 10.1.20 on July 20.
Agencies issue Zimbra flaw warnings
The US Cybersecurity and Infrastructure Security Agency (CISA) last week added the flaw to its Known Exploited Vulnerabilities (KEV) list and ordered US federal civilian agencies to address it within three days.
However, it appears that the vulnerability is still being actively exploited.
Non-profit security organization Shadowserver said it has spotted at least 274 internet-exposed Zimbra instances that have been breached.
Meanwhile, at least 8,200 organizations worldwide are still using vulnerable versions, although this doesn't mean they're exploitable as the vulnerability may be in a non-default configuration.
Dray Agha, senior manager of Huntress’ EMEA security operations center, said the exploitation of the flaw highlights the importance of rapid patching.
"This widespread compromise of Zimbra servers is a textbook example of the enterprise patching gap. The patch for CVE-2026-73570 was released in July, yet weeks later, attackers are still easily finding hundreds of vulnerable instances to exploit," he said.
"When dealing with an unauthenticated, remote code execution flaw on an internet-facing email server, the window for remediation isn't measured in weeks or days, it’s honestly measured in hours. Organizations need to treat collaboration suites as highly critical perimeter infrastructure and patch them with zero delay."
It's not clear who is behind the attacks, but exploitation of Zimbra vulnerabilities has in the past been linked to Russian state-sponsored hackers, including APT28, APT29, and Winter Vivern.
These groups have targeted military and diplomatic intelligence, alongside opportunistic cybercriminals seeking financial gain.
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
McKinsey says AI is finally delivering results for enterprises – but there's a catch
Most business leaders aren't completely sure what 'sovereign AI' means
