Zimbra

Overview

Zimbra Collaboration Suite (ZCS) is an open-source email and collaboration platform maintained by Synacor, widely deployed in government, education, and enterprise environments. As of September 2026, approximately 10,000 internet-facing instances remain tracked by the Shadowserver Foundation.

Recent Developments

• 2026-09-30: microsoft warns active exploitation of CVE-2026-73570 — unauthenticated remote code execution via crafted email targeting SNMP notification path when zimbra-snmp package is installed and SNMP notifications enabled (2026-09-30-zimbra-cve-2026-73570-exploitation)
• 2026-07-20: Synacor patched vulnerability; public disclosure delayed >3 weeks
• 2026-08: Shadowserver tracked 274 compromised instances; post-patch instance count dropped from ~19,000 to ~10,000

Attack Chain (verified by Microsoft)

1. Internet-wide scanning for vulnerable endpoints (Jul 28–Aug 7, 2026)
2. Exploit validation via HTTP, DNS, ICMP out-of-band checks
3. JSP web shell deployment, reverse shells, privilege escalation
4. Email backup and credential harvesting with archive transfer

Mitigation

Upgrade to ZCS 10.1.20 or later. Disable or remove zimbra-snmp if SNMP notifications are not required.

Related

• synacor
• cybersecurity
• ai-security
• supply-chain-security
• microsoft

Sources

• 2026-09-30-zimbra-cve-2026-73570-exploitation