Project
Email and collaboration server suite with mail, calendar, contacts and a web client, widely self-hosted by businesses and governments.
Rapid7 reported more than 80 vulnerabilities in Zimbra Collaboration Suite and is releasing them in stages while fixes land on different schedules. The first five include a login-limit bypass and flaws that work from one ordinary compromised account.
Reality
Attackers are exploiting Zimbra Collaboration Suite flaw CVE-2026-73570, which Synacor fixed quietly in 10.1.20 on July 20 and disclosed on August 13. An upgrade closes the injection path, but a web shell written earlier stays on disk until someone finds it.
Reality
Microsoft says attackers are using CVE-2026-73570 to run commands on Zimbra mail servers with one crafted email and no login. Zimbra shipped the fix in 10.1.20 on July 20, 24 days before disclosure, so anyone who waited for the advisory to patch was already late.
Perspective Coverage
4 publishersReality
The release Zimbra rates High severity closes a command injection in SNMP monitoring plus four Classic Web Client scripting bugs. Sites that acted on the June advisory still have work queued.
Reality
Gitea shipped a fix for CVE-2026-60004 on July 27 and CISA gave federal agencies until August 28, yet a month later Shadowserver still counts 8,393 exposed instances, and on shipped defaults the bug needs no credentials.
Perspective Coverage
7 publishersReality
CERT Polska says CVE-2026-73570 is already being exploited. Two of the three preconditions are configuration, not code, which makes reachability the control you can change now.
Reality