CISA Orders 3-Day Patch for Actively Exploited Zimbra RCE Flaw

Q: Following 2025's massive breaches, which unknown threat actor is currently weaponizing this new Zimbra flaw to steal sensitive email data?

It is not publicly known who is weaponizing CVE-2026-73570 right now to steal email data. In the current reporting on the newly exploited Zimbra flaw, CERT Polska and CISA confirmed active exploitation, but neither identified the threat actor. Multiple summaries explicitly say the actor behind the attacks and its motivation remain unclear. So there is no verified attribution yet for the campaign exploiting this SNMP-related command-injection bug. What is known is that Zimbra has recently been a major espionage target. Following the 2025 breach wave, the best-documented actor stealing sensitive email data from Zimbra was the Russian state-aligned group tracked as LAUNDRY BEAR, also known as Void Blizzard and TA488. U.S. and allied agencies, along with Proofpoint, said that group exploited the earlier zero-day CVE-2025-66376 to exfiltrate up to 90 days of email, credentials, contact data, and authentication material from Western government and commercial organizations. But that attribution applies to the 2025-2026 webmail XSS campaign, not to the newly disclosed CVE-2026-73570 exploitation. At present, the safest answer is that the actor using the new flaw remains unidentified, even though past Zimbra targeting has included groups such as LAUNDRY BEAR, APT28, APT29, and Winter Vivern.

3 articles · Updated · BleepingComputer · Aug 24

U.S. federal civilian agencies were told to secure Zimbra Collaboration Suite by Aug. 24 after CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog.
Zimbra fixed the bug in version 10.1.20 on July 20; the flaw lets unauthenticated attackers execute OS commands through command injection in the SNMP monitoring component when notifications are enabled.
CERT Polska first reported in-the-wild targeting last week, and Shadowserver said Monday it found more than 270 compromised Zimbra instances while tracking exploitation artifacts.
Shadowserver also sees more than 12,000 internet-exposed Zimbra servers, though it is unclear how many are honeypots or already patched.
Zimbra has repeatedly drawn state-linked attacks, including campaigns tied to APT28, APT29 and Winter Vivern against government and NATO-aligned targets.