Shadowserver Confirms 274 Zimbra Servers Compromised via CVE-2026-73570

At least 274 internet-facing Zimbra servers have already been compromised through CVE-2026-73570, the code-injection flaw in Zimbra Collaboration Suite (ZCS) that Synacor patched back in July. That count comes from the Shadowserver Foundation, whose daily internet-wide scans have put a hard number on a vulnerability regulators had already flagged as under active attack.

The confirmed scale is what is new here. When CERT Polska first warned that CVE-2026-73570 was being exploited in the wild, defenders knew the flaw was dangerous but not how far attackers had gotten. Shadowserver’s scan data answers that: 155 compromised instances on August 20, climbing past 274 within days, with roughly 8,200 more Zimbra servers still running versions old enough to be at risk. “At least 274 internet-facing Zimbra instances have been compromised by unknown attackers via CVE-2026-73570,” Help Net Security reported on August 25, citing the Shadowserver figures.

What Shadowserver Actually Counted

Shadowserver’s 274 is a count of hosts showing signs of compromise, not simply hosts that are vulnerable. That distinction matters: it is the difference between exposure and a confirmed foothold. The nonprofit runs daily scans across most of the routable IPv4 space, matching what it sees against the indicators CERT Polska published, and the number has moved in one direction since the first tally.

The 8,200 figure is a separate, larger pool: Zimbra servers that have not yet been updated to ZCS v10.1.20. Shadowserver was careful to note that not all of those are necessarily exploitable, because CVE-2026-73570 only bites in a specific configuration (more on that below). Even so, an unpatched, internet-facing mail server running months behind a known-exploited fix is not a host you want to leave unexamined.

Two things the data does not tell us. There is no public attribution: Help Net Security described the operators only as “unknown attackers,” and no named victims have been confirmed. Shadowserver also has not published a country-by-country breakdown of the 274, so any geographic characterization at this point would be guesswork. Treat both as open questions, not settled facts.

For teams doing that examination, CERT Polska did the groundwork. Its advisory shipped with a set of indicators, the specific log entries and files that show up on a compromised host, which is what Shadowserver matched its scans against. That matters for defenders: a compromise audit is not a vague exercise but a concrete checklist you can run against your own mail servers, and it is the same evidence CISA told federal agencies to hunt for when it set its three-day deadline.

How CVE-2026-73570 Reached This Point

CVE-2026-73570 is a code-injection vulnerability in Zimbra Collaboration Suite. It was first disclosed on June 26, 2026, with a temporary mitigation available while a full fix was prepared. Synacor shipped that fix in ZCS v10.1.20 on July 20, 2026. The gap between a public disclosure in late June and a confirmed compromise wave in late August is the familiar shape of edge-software risk: the patch existed for over a month before Shadowserver’s count crossed 274.

The exposure is narrower than a blanket “all Zimbra servers” would suggest. According to Help Net Security, the flaw affects mailservers that have the optional zimbra-snmp package installed and SNMP notifications enabled, which is not a default state. If you run Zimbra, that is the first thing to check: whether your hosts are actually in the configuration the vulnerability requires. Being on a pre-10.1.20 build is the necessary condition; the SNMP setup is what turns exposure into something attackers can reach.

Zimbra has been a recurring target this year, which is part of why this one deserves attention rather than fatigue. The platform has drawn state-sponsored zero-day activity and separate actively exploited client-side flaws in recent months. A mail server holds credentials, correspondence, and a foothold into the rest of the network, which is exactly what makes it worth an attacker’s time and worth a defender’s priority.

Where CISA Stands

CVE-2026-73570 is on CISA’s Known Exploited Vulnerabilities catalog, added on August 21, 2026 under Binding Operational Directive 26-04. The agency gave U.S. federal civilian agencies three days to remediate, a deadline that expired on August 24, and told them not just to patch but to check their systems for evidence of compromise. That KEV listing is current as of this writing.

Various secondary trackers have attached a CVSS severity score to the flaw, but the figures circulating are not consistent enough to state as authoritative here, so I am not anchoring urgency to a number. The KEV listing and a confirmed, rising compromise count are a stronger signal than any single severity rating anyway: this is a vulnerability being used, not a theoretical one.

What Defenders Should Do Now

The response splits cleanly along one question: are your Zimbra hosts patched, or not? The triage below is deliberately binary, because with a known-exploited flaw and a public compromise count, the middle ground has already closed.

A patch-and-audit triage for CVE-2026-73570: version check first, and any host left unpatched since July moves straight to assume-breach. Diagram: The CyberSignal.

Concretely, that means four moves. Verify that every Zimbra deployment is running v10.1.20 or later. Audit exposed hosts for the compromise indicators CERT Polska published, rather than assuming a clean patch closes the book. Review outbound traffic from mail servers for anomalies, since a compromised host’s value to an attacker is the pivot it offers to the rest of your environment. And if a server sat unpatched and internet-facing at any point since July, work the incident as an assume-breach: patching a box that was already reachable does not evict anyone who got in first.

My read: the useful signal in this story is not that another Zimbra flaw exists, it is that Shadowserver turned an abstract advisory into a measured, still-climbing number. A KEV entry tells you to patch; a confirmed count of 274 compromised hosts tells you that patching alone is no longer the whole job for anyone who was slow. If your Zimbra fleet was exposed before late July, the honest posture is to assume you are in the affected set until your own hunt says otherwise. That is an assessment, not a reported fact, but it is the one the timeline supports.

Primary Documents

• Help Net Security: Unpatched Zimbra servers are falling to CVE-2026-73570 attacks (August 25, 2026), reporting the Shadowserver count.
• Shadowserver Foundation compromise-count post.
• CERT Polska advisory with exploitation indicators.
• Zimbra: ZCS v10.1.20 patch release notes (July 20, 2026).
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-73570 added August 21, 2026).