Hackers Target Zimbra Servers in Active Exploitation Campaign

Summary

Poland's CERT Polska has observed active exploitation of the Zimbra Collaboration vulnerability CVE-2026-73570. This high-severity flaw, which allows unauthenticated attackers to execute arbitrary OS commands, was patched in version 10.1.20. Exploitation could lead to full server control, credential harvesting, and lateral movement. While the threat actor and motivation are unclear, past Zimbra exploits have been linked to Russian and Chinese state-sponsored groups.

Full text

A recently patched Zimbra Collaboration vulnerability is being exploited in the wild, according to Poland’s CERT Polska. The security hole is tracked as CVE-2026-73570 and it was patched by the developers of the enterprise email server and collaborative software suite with the release of version 10.1.20, announced on July 20. The high-severity flaw exists when the optional ‘zimbra-snmp’ package is installed and SNMP notifications are enabled. An attacker can exploit the vulnerability without authentication to execute arbitrary OS commands as the Zimbra user. The Polish CERT announced seeing attacks this week but did not share any details about the active exploitation campaign. It did, however, share some indicators of compromise (IoCs). The threat actor behind these attacks and its motivation remain unclear. However, these vulnerabilities can allow threat actors to gain full control of a targeted Zimbra server. The hackers can then establish persistence, access email accounts, harvest credentials, and move laterally to other systems.Advertisement. Scroll to continue reading. CISA’s KEV catalog currently includes 18 Zimbra Collaboration Suite vulnerabilities, including four added this year. CVE-2026-73570 has yet to be added to the catalog. Exploitation of Zimbra vulnerabilities has frequently been linked to Russian and Chinese state-sponsored hackers targeting military and diplomatic intelligence, as well as opportunistic cybercriminals seeking financial gain. Related: MLflow Vulnerability Exploited for Cloud Credential Theft Related: Critical GitLab Flaw Exploited Shortly After Disclosure Related: Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Hackers Using AI to Target Siemens PLCs in Critical US SectorsCl0p Ransomware Group Names Over 40 Victims of PTC Windchill CampaignCareCloud Data Breach Impact Grows to 3.7 Million IndividualsFortinet Acquires AI Security Company Virtue AIIrregular Details How a Naming Error Let AI Models Attack a Real Company Conflicting Test Goals Pushed Claude Agents to Deploy Self-Replicating MalwareCritical SAP Commerce Cloud Vulnerability Exploited 3 Days After DisclosureGoogle Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal Latest News Surveillance – Everything You Wanted to Know, But Were Afraid to AskThreat Actor Hacks 14,000 IP Cameras in Ukraine and RussiaAtlassian, Splunk Patch Dozens of Critical, High-Severity VulnerabilitiesMLflow Vulnerability Exploited for Cloud Credential TheftCisco Patches Critical Crosswork, Secure Workload VulnerabilitiesAI-Assisted Tool Helped Secure Satellite Communication System After 2022 Russian HackingOpenAI Overhauls Model Security With Sandboxing, 30-Minute Alerts, and Training PausesExploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveDaniel Dubowski has been named Senior Vice President and Chief Information Security Officer at Marriott International.Allied Universal has named Jordan Avnaim Global Chief Information Security Officer.Cycode has promoted Seth Robbins to President and Chief Revenue Officer.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-73570

Entities