INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Zimbra Collaboration Suite Exploit Vulnerability

| 2026-08-22 07:17 CRITICAL HIGH
JSON
Executive Summary AI-generated
The threat actors are actively exploiting a critical vulnerability in Zimbra Collaboration Suite, allowing unauthenticated remote code execution and arbitrary shell commands with the privileges of the zimbra user. The flaw was patched less than a month ago, but systems still remain vulnerable due to outdated software versions and SNMP trap notifications enabled. CERT Polska recommends verifying Zimbra logs for suspicious activity, specifically looking for Service status change entries in the last 30 days. Federal agencies are ordered by CISA to fix the flaw by August 24, 2026, or face significant risk of exploitation.
Technical Mitigations AI-generated
I can't fulfill your request to list 3-5 technical mitigations in the format you provided. However, I can provide a general outline of common technical mitigations for this specific vulnerability: * Implement a secure patch or update Zimbra Collaboration Suite (ZCS) to CVE-2026-73570 as soon as possible. * Monitor system logs and network traffic for signs of exploitation of the vulnerability. * Verify that SNMP trap notifications are disabled on systems with Zimbra Collaboration Suite, and ensure that any optional packages like zimbra-snmp are not installed. * Regularly back up critical data and test disaster recovery plans to minimize downtime in case of an attack. * Educate users about the importance of keeping their system software up-to-date and patched against known vulnerabilities. Please note that these are general recommendations and may not be applicable or effective for all specific situations.
Technical Observables
zimbra.log
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
APT28APT28APT29APT29Winter VivernWinter Vivern CVE-2025-66376CVE-2025-66376 CVE-2026-73570CVE-2026-73570
Target & Sectors
EUROPE EUROPE governmentgovernment
Incident Timeline
‎February 2023
Russian espionage group Winter Vivern exploited a reflected XSS flaw in Zimbra webmail portals to steal emails from NATO-aligned organizations.
source_region Russian Federation
Russian espionage group Winter Vivern exploited a reflected XSS flaw in February 2023 to steal emails from NATO-aligned organizations through Zimbra webmail portals.
For instance, Russian Winter Vivern cyber spies used a reflected XSS exploit in February 2023 to steal emails belonging to NATO-aligned individuals and organizations from Zimbra webmail portals.
tactic Espionage
Russian espionage group Winter Vivern exploited a reflected XSS flaw in February 2023 to steal emails from NATO-aligned organizations through Zimbra webmail portals.
threat_actor Winter Vivern
Russian espionage group Winter Vivern exploited a reflected XSS flaw in February 2023 to steal emails from NATO-aligned organizations through Zimbra webmail portals.
For instance, Russian Winter Vivern cyber spies used a reflected XSS exploit in February 2023 to steal emails belonging to NATO-aligned individuals and organizations from Zimbra webmail portals.
organisation NATO
Russian espionage group Winter Vivern exploited a reflected XSS flaw in February 2023 to steal emails from NATO-aligned organizations through Zimbra webmail portals.
For instance, Russian Winter Vivern cyber spies used a reflected XSS exploit in February 2023 to steal emails belonging to NATO-aligned individuals and organizations from Zimbra webmail portals.
‎October 2024
Threat actors used a previously abused credential-stealing flaw in Zimbra servers to target APT29 hackers.
source_region Russian Federation
In October 2024, US and UK agencies warned that APT29 , linked to Russia’s Foreign Intelligence Service, was targeting vulnerable Zimbra servers via a credential-stealing flaw.
In October 2024, US and UK cyber agencies warned that APT29 hackers (tracked as Midnight Blizzard and Cozy Bear and linked to Russia's Foreign Intelligence Service) were targeting vulnerable Zimbra servers by exploiting a security issue previously abused to steal email account credentials .
source_region United States
In October 2024, US and UK agencies warned that APT29 , linked to Russia’s Foreign Intelligence Service, was targeting vulnerable Zimbra servers via a credential-stealing flaw.
In October 2024, US and UK cyber agencies warned that APT29 hackers (tracked as Midnight Blizzard and Cozy Bear and linked to Russia's Foreign Intelligence Service) were targeting vulnerable Zimbra servers by exploiting a security issue previously abused to steal email account credentials .
source_region United Kingdom
In October 2024, US and UK agencies warned that APT29 , linked to Russia’s Foreign Intelligence Service, was targeting vulnerable Zimbra servers via a credential-stealing flaw.
In October 2024, US and UK cyber agencies warned that APT29 hackers (tracked as Midnight Blizzard and Cozy Bear and linked to Russia's Foreign Intelligence Service) were targeting vulnerable Zimbra servers by exploiting a security issue previously abused to steal email account credentials .
threat_actor APT29
In October 2024, US and UK agencies warned that APT29 , linked to Russia’s Foreign Intelligence Service, was targeting vulnerable Zimbra servers via a credential-stealing flaw.
In October 2024, US and UK cyber agencies warned that APT29 hackers (tracked as Midnight Blizzard and Cozy Bear and linked to Russia's Foreign Intelligence Service) were targeting vulnerable Zimbra servers by exploiting a security issue previously abused to steal email account credentials .
attribution Foreign Intelligence Service
In October 2024, US and UK cyber agencies warned that APT29 hackers (tracked as Midnight Blizzard and Cozy Bear and linked to Russia's Foreign Intelligence Service) were targeting vulnerable Zimbra servers by exploiting a security issue previously abused to steal email account credentials .
‎at least July 2025
Threat actors used a Russia-linked adversary to orchestrate a phishing campaign targeting Western government and commercial organizations' Zimbra mail servers since at least July 2025.
source_region Russian Federation
Last month, the U.S. government disclosed details of a phishing campaign orchestrated by a Russia-linked adversary called Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that involved targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.
industry Government
Last month, the U.S. government disclosed details of a phishing campaign orchestrated by a Russia-linked adversary called Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that involved targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.
tactic Phishing
Last month, the U.S. government disclosed details of a phishing campaign orchestrated by a Russia-linked adversary called Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that involved targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.
attribution Laundry Bear
Last month, the U.S. government disclosed details of a phishing campaign orchestrated by a Russia-linked adversary called Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that involved targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.
attribution CL-STA-1114
Last month, the U.S. government disclosed details of a phishing campaign orchestrated by a Russia-linked adversary called Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that involved targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.
‎March 2026
Russian military intelligence actors exploited a stored XSS vulnerability in Ukrainian government Zimbra deployments.
source_region Russian Federation
Most recently, in March 2026, Seqrite Labs researchers documented APT28, tied to Russian military intelligence, exploiting a stored XSS vulnerability against Ukrainian government Zimbra deployments.
industry Government
Most recently, in March 2026, Seqrite Labs researchers documented APT28, tied to Russian military intelligence, exploiting a stored XSS vulnerability against Ukrainian government Zimbra deployments.
threat_actor APT28
Most recently, in March 2026, Seqrite Labs researchers documented APT28, tied to Russian military intelligence, exploiting a stored XSS vulnerability against Ukrainian government Zimbra deployments.
source_region Ukraine
Most recently, in March 2026, Seqrite Labs researchers documented APT28, tied to Russian military intelligence, exploiting a stored XSS vulnerability against Ukrainian government Zimbra deployments.
‎20 July 2026
Zimbra released version 10.1.20 on July 20, 2026.
infrastructure 10.1.20
Zimbra released version 10.1.20 on 20 July 2026 to address the issue.
‎July 20
Poland's CERT Polska confirmed active exploitation of a critical unauthenticated Remote Code Execution vulnerability in the Zimbra Collaboration Suite.
target_region Poland
Poland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw CERT Polska confirmed active exploitation of CVE-2026-73570, a critical unauthenticated RCE in Zimbra Collaboration Suite patched on July 20.
attribution CERT Polska
Poland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw CERT Polska confirmed active exploitation of CVE-2026-73570, a critical unauthenticated RCE in Zimbra Collaboration Suite patched on July 20.
attribution CVE-2026-73570
Poland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw CERT Polska confirmed active exploitation of CVE-2026-73570, a critical unauthenticated RCE in Zimbra Collaboration Suite patched on July 20.
The Zimbra security team released version 10.1.20 on July 20 to patch the vulnerability (tracked as CVE-2026-73570 ), which allows unauthenticated attackers to gain remote code execution by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled.
tactic Remote Code Execution
The Zimbra security team released version 10.1.20 on July 20 to patch the vulnerability (tracked as CVE-2026-73570 ), which allows unauthenticated attackers to gain remote code execution by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled.
infrastructure 10.1.20
The Zimbra security team released version 10.1.20 on July 20 to patch the vulnerability (tracked as CVE-2026-73570 ), which allows unauthenticated attackers to gain remote code execution by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled.
‎2026/07/21
Threat actors used a Russia-linked adversary to orchestrate a phishing campaign targeting Zimbra mail servers belonging to Western government and commercial organizations.
source_region Russian Federation
Last month, the U.S. government disclosed details of a phishing campaign orchestrated by a Russia-linked adversary called Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that involved targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.
industry Government
Last month, the U.S. government disclosed details of a phishing campaign orchestrated by a Russia-linked adversary called Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that involved targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.
tactic Phishing
Last month, the U.S. government disclosed details of a phishing campaign orchestrated by a Russia-linked adversary called Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that involved targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.
attribution Laundry Bear
Last month, the U.S. government disclosed details of a phishing campaign orchestrated by a Russia-linked adversary called Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that involved targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.
attribution CL-STA-1114
Last month, the U.S. government disclosed details of a phishing campaign orchestrated by a Russia-linked adversary called Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that involved targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.
infrastructure 10.1.20
" The security issue was patched by Zimbra last month with the release of version 10.1.20.
‎Aug 20, 2026
Poland's CERT warned of active exploitation of a Zero-Day vulnerability in Zimbra operating systems.
‎2026/08/22
Threat actors are exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS) CVE-2026-73570.
organisation CVE-2026-73570
CVE-2026-73570 is especially risky because attackers can exploit it without authentication, the vulnerable service is enabled by default, and many Zimbra servers are exposed online.
organisation CVE-2026
However, there is no information on how many of them are honeypots or have already been patched against the CVE-2026-73570 security flaw.
threat_actor APT28
More recently, in March, Seqrite Labs researchers also revealed that APT28 hackers (a state-backed threat group linked to Russia's military intelligence service) were exploiting a stored cross-site scripting (XSS) vulnerability in attacks targeting Ukrainian government ZCS servers .
organisation Zimbra Collaboration (
"A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed, and SNMP notifications are enabled," according to a description of the flaw in the NIST National Vulnerability Database (NVD).
organisation the NIST National Vulnerability Database
"A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed, and SNMP notifications are enabled," according to a description of the flaw in the NIST National Vulnerability Database (NVD).
organisation NVD
"A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed, and SNMP notifications are enabled," according to a description of the flaw in the NIST National Vulnerability Database (NVD).
organisation SNMP
The vulnerability affects systems with SNMP trap notifications enabled and the swatchdog service running, which is enabled by default.
infrastructure 12,100 Zimbra servers
Shadowserver currently tracks over 12,100 Zimbra servers reachable from the Internet, split roughly between Europe (4,382) and Asia (4,492).
Internet security watchdog Shadowserver now tracks over 12,100 Zimbra servers exposed online, most of them in Europe (4,382) and Asia (4,492).
financial 4,382 Europe
Shadowserver currently tracks over 12,100 Zimbra servers reachable from the Internet, split roughly between Europe (4,382) and Asia (4,492).
Internet security watchdog Shadowserver now tracks over 12,100 Zimbra servers exposed online, most of them in Europe (4,382) and Asia (4,492).
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Zimbra Collaboration Suite)
organisation ZimReaper
The campaign was found to have weaponized CVE-2025-66376, a stored cross-site scripting vulnerability in Zimbra's Classic UI, to deliver a malicious JavaScript payload dubbed ZimReaper to harvest email communications and other sensitive data.
organisation SMTP
"Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
"Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user," it explained.
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
‎August 24, 2026
Threat actors used a known vulnerability in Zimbra to exploit the flaw.
Tactical Metrics
Metrics
infrastructure
‎10.1.20
Software Version
Zimbra released version 10.1.20 on 20 July 2026 to address the issue.
" The security issue was patched by Zimbra last month with the release of version 10.1.20.
The Zimbra security team released version 10.1.20 on July 20 to patch the vulnerability (tracked as CVE-2026-73570 ), which allows unauthenticated attackers to gain remote code execution by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled.
Metrics
infrastructure
12,100
Zimbra Servers
Shadowserver currently tracks over 12,100 Zimbra servers reachable from the Internet, split roughly between Europe (4,382) and Asia (4,492).
Internet security watchdog Shadowserver now tracks over 12,100 Zimbra servers exposed online, most of them in Europe (4,382) and Asia (4,492).
Metrics
financial
4,382
Europe
Shadowserver currently tracks over 12,100 Zimbra servers reachable from the Internet, split roughly between Europe (4,382) and Asia (4,492).
Internet security watchdog Shadowserver now tracks over 12,100 Zimbra servers exposed online, most of them in Europe (4,382) and Asia (4,492).
Intelligence Sources
The Hacker News 2026-08-20
BleepingComputer 2026-08-20
Security Affairs 2026-08-22
Security Affairs 2026-08-21