--- title: CISA orders urgent patching of actively exploited Zimbra... description: CISA has ordered U.S. federal agencies to patch an actively exploited command injection vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite within... canonical: https://daily.dev/posts/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw-qhaitejg7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CISA orders urgent patching of actively exploited Zimbra flaw | daily.dev og:description: CISA has ordered U.S. federal agencies to patch an actively exploited command injection vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite within... og:url: https://daily.dev/posts/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw-qhaitejg7 og:image: https://api.daily.dev/og/posts/QHaITEJg7.png og:image:alt: CISA orders urgent patching of actively exploited Zimbra flaw og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CISA orders urgent patching of actively exploited Zimbra flaw **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary CISA has ordered U.S. federal agencies to patch an actively exploited command injection vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite within three days, by August 24. The flaw, found in the SNMP monitoring component, allows unauthenticated attackers to achieve remote code execution as the Zimbra user when SNMP notifications are enabled. Zimbra patched the issue in version 10.1.20, released July 20, after CERT Polska flagged active exploitation in the wild. Over 12,000 Zimbra servers are exposed on the internet, and Zimbra has a history of being targeted by state-sponsored groups like APT28 and APT29. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-73570 and how does it affect Zimbra Collaboration Suite? CVE-2026-73570 is a command injection vulnerability in the SNMP monitoring component of Zimbra Collaboration Suite that allows unauthenticated attackers to achieve remote code execution. Due to improper sanitization of untrusted input during SNMP notification processing, attackers can send specially crafted SMTP requests to execute arbitrary OS commands as the Zimbra user when SNMP notifications are enabled. _Teams tracking Zimbra exposure can follow vulnerability disclosures like this one on daily.dev._ ### Which Zimbra version fixes the actively exploited SNMP command injection flaw? Zimbra fixed the SNMP command injection vulnerability, CVE-2026-73570, in version 10.1.20, released on July 20. CISA later added the flaw to its Known Exploited Vulnerabilities catalog and gave U.S. federal agencies until August 24, three days, to patch after CERT Polska confirmed active exploitation. _daily.dev helps admins stay on top of urgent patch deadlines like this Zimbra fix._ ### How can I check if my Zimbra server was compromised via the SNMP RCE vulnerability? Check logs for unexpected Zimbra service restarts and inspect the /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ directories for files created by the zimbra user over the last 30 days, as recommended by CERT Polska following active exploitation of CVE-2026-73570. _Security teams investigating incidents like this one can track follow-up coverage on daily.dev._ ## Similar posts on daily.dev - [Over 10,000 Zimbra servers vulnerable to ongoing XSS attacks](https://daily.dev/posts/over-10-000-zimbra-servers-vulnerable-to-ongoing-xss-attacks-f0dcy8pcn) · BleepingComputer · 0 upvotes · 0 comments - [Critical Zimbra security update fixes 9 vulnerabilities](https://daily.dev/posts/critical-zimbra-security-update-fixes-9-vulnerabilities-9ezatfhm8) · CSO Online · 0 upvotes · 0 comments - [Zimbra urges customers to patch critical web client XSS flaw](https://daily.dev/posts/zimbra-urges-customers-to-patch-critical-web-client-xss-flaw-ecfk9jpn7) · BleepingComputer · 0 upvotes · 0 comments - [Zimbra Zero-Day Exploited to Target Brazilian Military via Malicious ICS Files](https://daily.dev/posts/zimbra-zero-day-exploited-to-target-brazilian-military-via-malicious-ics-files-brq2xsuge) · The Hacker News · 1 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw-qhaitejg7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CISA orders urgent patching of actively exploited Zimbra flaw","url":"https://daily.dev/posts/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw-qhaitejg7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw-qhaitejg7"},"datePublished":"2026-08-24T10:48:25.087Z","dateModified":"2026-08-25T12:11:23.393Z","description":"CISA has ordered U.S. federal agencies to patch an actively exploited command injection vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite within...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1928e5da7eda88d254b416c8d6bf502a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1928e5da7eda88d254b416c8d6bf502a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw-qhaitejg7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"CISA orders urgent patching of actively exploited Zimbra flaw"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw-qhaitejg7#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-73570 and how does it affect Zimbra Collaboration Suite?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-73570 is a command injection vulnerability in the SNMP monitoring component of Zimbra Collaboration Suite that allows unauthenticated attackers to achieve remote code execution. Due to improper sanitization of untrusted input during SNMP notification processing, attackers can send specially crafted SMTP requests to execute arbitrary OS commands as the Zimbra user when SNMP notifications are enabled. Teams tracking Zimbra exposure can follow vulnerability disclosures like this one on daily.dev."}},{"@type":"Question","name":"Which Zimbra version fixes the actively exploited SNMP command injection flaw?","acceptedAnswer":{"@type":"Answer","text":"Zimbra fixed the SNMP command injection vulnerability, CVE-2026-73570, in version 10.1.20, released on July 20. CISA later added the flaw to its Known Exploited Vulnerabilities catalog and gave U.S. federal agencies until August 24, three days, to patch after CERT Polska confirmed active exploitation. daily.dev helps admins stay on top of urgent patch deadlines like this Zimbra fix."}},{"@type":"Question","name":"How can I check if my Zimbra server was compromised via the SNMP RCE vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Check logs for unexpected Zimbra service restarts and inspect the /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ directories for files created by the zimbra user over the last 30 days, as recommended by CERT Polska following active exploitation of CVE-2026-73570. Security teams investigating incidents like this one can track follow-up coverage on daily.dev."}}]} ```