Vulnerability
Unauthenticated OS command injection in Zimbra's SNMP notification processing enabling remote code execution as the zimbra user; reported as actively exploited.
Attackers are exploiting Zimbra Collaboration Suite flaw CVE-2026-73570, which Synacor fixed quietly in 10.1.20 on July 20 and disclosed on August 13. An upgrade closes the injection path, but a web shell written earlier stays on disk until someone finds it.
Reality
Microsoft says attackers are using CVE-2026-73570 to run commands on Zimbra mail servers with one crafted email and no login. Zimbra shipped the fix in 10.1.20 on July 20, 24 days before disclosure, so anyone who waited for the advisory to patch was already late.
Perspective Coverage
4 publishersReality
Gitea shipped a fix for CVE-2026-60004 on July 27 and CISA gave federal agencies until August 28, yet a month later Shadowserver still counts 8,393 exposed instances, and on shipped defaults the bug needs no credentials.
Perspective Coverage
7 publishersReality
Rapid7's research with Zimbra turned up more than 50 vulnerabilities, several of which let an attacker send mail as another user with no password involved. The operational item today is CVE-2026-73570, the SNMP command injection CISA gave federal agencies three days to fix.
Reality
CERT Polska says CVE-2026-73570 is already being exploited. Two of the three preconditions are configuration, not code, which makes reachability the control you can change now.
Reality