zimbra News Articles

Zimbra CVE-2026-73570 Harvested the Signing Keys That Authenticate Every Session on the Platform - NewsBreak

Harvested authentication secrets — specifically the zimbraPreAuthKey, zimbraAuthTokenKey, and zimbraTwoFactorAuthSecret — have transformed the exploitation

2 weeks ago

Zimbra Mail Servers Under Siege: How One Crafted Email Unlocked Mass Credential Theft

Attackers exploited CVE-2026-73570 in Zimbra Collaboration Suite by sending crafted emails that triggered unauthenticated command injection when SNMP notifications were enabled. Microsoft observed web shells, privilege escalation, and mailbox data theft on hundreds of servers before the flaw's publi...

2 weeks ago

Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure

Exploitation of CVE-2026-73570, an unauthenticated OS command injection in Zimbra, started shortly after patches rolled out.

2 weeks ago

Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets - SwapUpdate

Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to

2 weeks ago

Attackers have been exploiting critical Zimbra flaw to steal emails

A simple email gives the attackers the ability to remotely inject OS commands.

2 weeks ago

Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

Attackers exploited CVE-2026-73570 in Zimbra to deploy web shells and access mailbox data on servers with SNMP notifications enabled.

2 weeks ago

Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited - Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Unpatched Zimbra servers are falling to CVE-2026-73570

Exploited RCE Flaws and Infrastructure Attacks Define this Cybersecurity Week in August 2026 | eSecurity Planet

Weekly summary of Cybersecurity Insider newsletters for August 2026.

274 Zimbra Servers Compromised, 8,200 Unpatched

Attackers exploited CVE-2026-73570 to compromise 274 Zimbra servers, while 8,200 systems remain unpatched. Learn what administrators should check.

Hackers have breached hundreds of Zimbra servers, despite a patch having been available for weeks

The flaw allows attackers to trigger cross-site scripting, sensitive information disclosure, security restriction bypass, and remote code execution

Zimbra SNMP flaw actively exploited, 274 servers hit

CVE-2026-73570 is under active exploitation, and 274 Zimbra mail servers are already compromised. Here is what changed, and what admins should check now.

Hackers breached over 270 Zimbra servers in ongoing attacks

Threat actors have already compromised over 270 Zimbra instances in remote code execution attacks targeting a high-severity Zimbra Collaboration Suite (ZCS) vulnerability.

Unpatched Zimbra servers are falling to CVE-2026-73570 attacks - Help Net Security

At least 274 internet-facing Zimbra instances have been compromised by unknown attackers via CVE-2026-73570.

Exploited Zimbra Flaw Highlights Shrinking Window to Patch

CISA issued a 3-day deadline for agencies to patch a Zimbra security vulnerability, CVE-2026-73570, which allows full takeover of a user's communications.

Zimbra Collaboration Suite Vulnerability Actively Exploited in the Wild - IT Security News

2026-08-24 21:08 CERT Polska has warned that threat actors are actively exploiting CVE-2026-73570, a critical OS command-injection vulnerability in Zimbra Collaboration Suite that allows...

Zimbra Collaboration Suite Vulnerability Actively Exploited in the Wild

Threat Actors Exploit Critical Zimbra OS Command Injection Flaw (CVE-2026-73570) for Remote Code Execution.

CISA orders urgent patching of actively exploited Zimbra flaw

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies to patch an actively exploited vulnerability in Zimbra Collaboration Suite (ZCS) within three days.

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution - SwapUpdate

Ravie LakshmananAug 20, 2026Vulnerability / Email Security

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

Attackers exploit CVE-2026-73570 on Zimbra servers with zimbra-snmp installed and SNMP notifications enabled, allowing unauthenticated RCE.

Critical Zimbra RCE flaw now actively exploited in attacks

CERT Polska, the Polish Computer Emergency Response Team (CERT), warned that attackers have begun exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS).

Hackers Target Zimbra Servers in Active Exploitation Campaign

CVE-2026-73570, a recently patched Zimbra Collaboration vulnerability that allows remote command execution, is being exploited in the wild.

Russian Hackers Exploit Zimbra 0-Day Against US, Ukraine Targets

A state-sponsored threat group, dubbed "Laundry Bear," sends "half-click" phishing emails that require a victim only to open or preview the message.

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

Russian spies exploited CVE-2025-66376 in Zimbra to steal 90 days of mail, passwords, 2FA codes, and directories from Western targets.

Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities

Zimbra 10.1.20 fixes nine flaws, including SNMP command injection and CVE-2026-50055, which could enable email exfiltration.