Zimbra RCE Hit 274 Mail Servers — 8,200 Still Exposed

Most email security stories start with a person making a mistake. This one does not. CVE-2026-73570 lets an attacker who never authenticated run shell commands on your mail server, and the only prerequisite is a monitoring option many administrators enabled years ago and forgot. CISA gave federal agencies three days. Thousands of servers are still waiting.

Key Takeaways

• CVE-2026-73570 is an OS command injection flaw in Zimbra Collaboration Suite that lets an unauthenticated attacker run commands as the zimbra user, scored 8.9 by NIST's National Vulnerability Database.
• Shadowserver recorded 274 compromised Zimbra instances on 22 August 2026, up from 155 two days earlier, plus more than 8,200 unpatched servers still reachable.
• Zimbra shipped the fix in version 10.1.20 on 20 July 2026, a month before CISA added the flaw to its Known Exploited Vulnerabilities catalog with a 24 August federal deadline.
• CERT Polska confirmed exploitation in the wild on 17 August 2026, but no threat actor has been publicly linked to the 274 compromises and nobody has disclosed what data was taken.

What Is CVE-2026-73570?

CVE-2026-73570 is a command injection bug in Zimbra Collaboration Suite's SNMP monitoring component that hands an unauthenticated attacker code execution on the mail server. NIST's National Vulnerability Database entry puts it precisely: "Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user."

The mismatch is the point. Input arrives over SMTP, which your mail server must accept from strangers. The injection lands in SNMP, a monitoring subsystem unrelated to delivering mail. Attacker controlled data crosses from the component that has to be exposed into one nobody thought was reachable, classified as CWE-78.

NVD scores it 8.9, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L. Two fields matter more than the number: UI:N, no user interaction, and S:C, scope changed, reserved for a bug that escapes the component it started in.

Which Zimbra Servers Are Actually Vulnerable?

Only instances running the optional zimbra-snmp package with SNMP notifications on. CERT Polska's advisory 145/2026, published 17 August 2026, pins the conditions: the SNMP trap service enabled through the snmp_notify parameter, and the swatchdog service running. That second one is on by default.

The word "optional" is doing a lot of reassuring work, and the scan data undercuts it. A package almost nobody installed would not yield 274 compromises in a fortnight. SNMP monitoring is what an administrator enables once during the build, for a dashboard that may no longer exist.

How Many Servers Are Still Exposed?

More than 8,200 unpatched Zimbra instances were visible to internet wide scanning, on top of the 274 already compromised. The Shadowserver Foundation, a nonprofit running daily scans, reported "274 instances seen compromised in our scans for exploitation artifacts on 2026-08-22", via BleepingComputer.

The trajectory is worse than the total: 155 compromised instances on 20 August, 274 on 22 August. A 77 percent rise in 48 hours, while CISA was issuing its deadline. This campaign is scanning faster than defenders are patching.

Not all 8,200 are exploitable, since the SNMP package and notification setting are not universal. Nobody outside those networks can tell which qualify — the problem for administrators who have not looked.

The Timeline Is the Real Story

A fix existed for a month before the first compromise counts. Zimbra's 10.1.20 release notes, dated 20 July 2026, list it plainly: "Fixed a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled." No CVE number appears beside it, so an administrator reading that line in July could not know it was the one that mattered.

• 20 July 2026 — ZCS 10.1.20 ships the SNMP fix, unlabelled.
• 13 August 2026 — NVD publishes CVE-2026-73570, 24 days later.
• 17 August 2026 — CERT Polska reports active exploitation.
• 20 August 2026 — Shadowserver counts 155 compromised instances.
• 21 August 2026 — CISA adds the flaw to its Known Exploited Vulnerabilities catalog under BOD 26-04, naming Synacor's Zimbra Collaboration Suite.
• 22 August 2026 — Shadowserver's count reaches 274.
• 24 August 2026 — Federal patching deadline expires.

Three days to remediate a bug whose patch had sat on the vendor wiki for 32 days.

Why This Zimbra Bug Is Not Like the Others

Every Zimbra flaw we have covered this year needed a victim; this one needs a port. When Russian operators read three months of mail from targeted mailboxes, the entry point was a cross site scripting bug that somebody had to open a message to trigger, as in Russian hackers read 90 days of email with no click. The flaw Google's Threat Analysis Group reported, in Zimbra patches critical email XSS found by Google TAG, was the same shape: script injection in the web client, triggered by a rendered message.

CVE-2026-73570 removes the human. No mailbox to target, no message to craft, no recipient whose behaviour you must predict: an attacker points a scanner at the internet and takes whatever answers. That changes who is at risk. A small organization nobody would bother spear phishing is now worth taking, because taking it costs nothing extra.

What a Mail Server Compromise Means for Your Inbox

Code execution as the zimbra user is not a foothold on an adjacent machine. It is the service account owning the mail store, so an attacker is inside the system holding every message rather than outside guessing passwords. That puts in reach mailbox contents for every user on the host, address books, server side filters and forwarding rules, and session tokens.

Forwarding rules deserve particular attention: a rule quietly added to an executive's account keeps delivering mail long after the hole is patched and the incident is closed, the same durable mailbox access we covered in hijacked Outlook inboxes that bypass MFA. The web application directories CERT Polska flags are also where a web shell would be dropped.

One thing nobody has said, and we will not fill in: what the attackers took from these 274 servers. Neither CERT Polska nor Shadowserver has published a finding on stolen data, and no victim has come forward. Zimbra carries government, university and hosting provider mail across Europe and Asia, so the exposure is not trivial. The scope stays undisclosed.

How Do You Check Whether Your Server Was Hit?

Patching is not sufficient: a server compromised in early August stays compromised after the update. Work through CERT Polska's indicators in order:

• Upgrade to ZCS 10.1.20 or later, treating anything below that as vulnerable if the SNMP package is present.
• Grep /var/log/zimbra.log for injected service names. CERT Polska flags "Service status change: <malicious payload> changed from stopped to running" and the matching transition back. The payload sits where a service name belongs, so anything unrecognizable is a finding.
• List files the zimbra user created in the last 30 days under /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/ and /tmp/: new files in the first two are web shell territory.
• Audit forwarding rules and filters across all mailboxes, not just sensitive ones. This is the persistence that survives a clean rebuild.
• Rotate credentials and invalidate sessions if you find anything, and disable SNMP notifications where monitoring is unused.

If you are a user rather than an administrator, no client side setting or browser extension changes this: the exposure is on the server. Ask your IT team which ZCS version runs and whether the log review is done.

Who Is Behind the 274 Compromises?

Publicly, nobody knows. No agency or vendor has attributed the campaign, and the reporting on the compromises says the operators remain unidentified.

Zimbra has a long history with state aligned groups: APT28 against Ukrainian government servers, APT29 stealing mail credentials, Winter Vivern targeting NATO aligned organizations. That explains why a Zimbra bug draws attention within hours, but it is not evidence about these 274 servers. Treating it as such is guessing with a famous name attached.

Sources: NIST NVD: CVE-2026-73570; CISA Known Exploited Vulnerabilities Catalog; CERT Polska advisory 145/2026; Zimbra Releases 10.1.20; Zimbra Security Advisories; MITRE CWE-78; CISA BOD 26-04; Shadowserver Foundation dashboard; BleepingComputer: Hackers breached over 270 Zimbra servers in ongoing attacks. Scan counts and catalog entries were checked on 26 August 2026 and change as the campaign continues.