Attackers are actively exploiting CVE-2026-73570 in Zimbra Collaboration (ZCS) — a command-injection flaw in the SNMP monitoring component that gives an unauthenticated attacker OS command execution as the zimbra user. The Shadowserver Foundation counted 274 compromised servers by 22 August, with about 8,200 still unpatched.
The bug requires a non-default setup — the optional zimbra-snmp package installed with SNMP notifications enabled — and is triggered via crafted SMTP requests. It was fixed in ZCS 10.1.20 (20 July) and is on CISA’s KEV list.
Why this matters in Cyprus
Plenty of Cyprus SMEs self-host Zimbra for email. A mail server holds correspondence, attachments, credentials and password-reset tokens. RCE there becomes a whole-organisation compromise, and under GDPR and NIS2 a reportable data breach. And patching alone isn’t enough: if the server was internet-facing in the vulnerable configuration, assume breach and hunt for web shells, stray cron jobs, modified logs, new SSH keys and unknown outbound connections.
Get ahead of it
Update to ZCS 10.1.20+ immediately; until then disable SNMP notifications and restrict access by IP. For Cyprus organisations we find exposed services and unsafe configurations with external network penetration testing and prove the real blast radius with an assumed-breach assessment. Get a fixed-price quote and we’ll check your perimeter.
Sources: Shadowserver Foundation; BleepingComputer, Help Net Security, The Hacker News; Synacor/Zimbra advisory; CISA KEV.