Over 270 Zimbra servers compromised in ongoing RCE attacks

Threat actors have compromised more than 270 Zimbra instances by exploiting CVE-2026-73570, a command injection flaw in the SNMP monitoring component. The vulnerability allows unauthenticated remote code execution when SNMP notifications are enabled, and was patched in ZCS 10.1.20. CERT Polska and CISA have warned about active exploitation, with Shadowserver reporting hundreds of breached servers.