Zimbra Command Injection Vulnerability Actively Exploited

A Zimbra command injection vulnerability is under active exploitation against on-premises mail servers; the CISA federal deadline already passed.

A Zimbra command injection vulnerability is under confirmed active exploitation against on-premises mail servers, and CISA’s federal remediation deadline of August 24 has already passed. Tracked as CVE-2026-73570, the flaw lets an unauthenticated attacker execute arbitrary shell commands on any unpatched Zimbra Collaboration Suite instance with SNMP notifications enabled — a configuration many administrators never…

Read More