---
title: CISA Gave Federal Agencies Three Days to Patch Actively Exploited Zimbra Flaw
description: Attackers were already exploiting a Zimbra flaw before CISA's deadline. Only servers with the optional SNMP package are exposed; ZCS 10.1.20 fixes it.
canonical_url: https://codekeeper.co/ticker/cisa-warns-of-critical-zimbra-vulnerability
---

[Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

# CISA Gave Federal Agencies Three Days to Patch Actively Exploited Zimbra Flaw

Attackers were already exploiting a Zimbra flaw before CISA's deadline. Only servers with the optional SNMP package are exposed; ZCS 10.1.20 fixes it.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 26, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-of-critical-zimbra-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-of-critical-zimbra-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-of-critical-zimbra-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-of-critical-zimbra-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-of-critical-zimbra-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-of-critical-zimbra-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

CISA added a Zimbra vulnerability, CVE-2026-73570 (CVSS 8.9, High), to its Known Exploited Vulnerabilities catalog on August 21, giving federal civilian agencies until August 24 to patch or stop using the software — a deadline that has now passed. The fix is Zimbra Collaboration Suite 10.1.20, released July 20. The flaw lets unauthenticated attackers run arbitrary OS commands as the Zimbra user through crafted SMTP requests. Exposure is narrower than it sounds — only servers with the optional zimbra-snmp package installed and SNMP notifications enabled are affected. CERT Polska flagged an active campaign hunting them on August 16. Merlin Group's Robert Costello notes that compromising a Zimbra server exposes messages, calendars, contacts and attachments, along with internal naming conventions and maintenance schedules — enough to fuel follow-on attacks. Patching won't evict an intruder already inside, so exposed servers need checking against CERT Polska's indicators, not just updating. Black Hills Information Security's John Strand argues AI is compressing the gap between disclosure and working exploit, pushing urgent patching closer to incident response than routine maintenance. Source: [Dark Reading](https://www.darkreading.com/vulnerabilities-threats/zimbra-flaw-exploitation-shrinking-window-patch)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-of-critical-zimbra-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-of-critical-zimbra-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-of-critical-zimbra-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-of-critical-zimbra-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-of-critical-zimbra-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-of-critical-zimbra-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Jordan Detains Alleged ShinyHunters Leader Oct 6, 2026](https://codekeeper.co/ticker/teen-hacker-rey-arrested-cooperates-with-fbi)

[Cybersecurity Firms Hit by Klue Supply Chain Attack Tied to Extortion Group Icarus Aug 12, 2026](https://codekeeper.co/ticker/klue-supply-chain-attack-huntress-recorded-future)

[Cyberattacks Cyber Incident Closes Everett City Hall to the Public for Three Days Sep 9, 2026](https://codekeeper.co/ticker/everett-city-hall-cyberattack-closure)

[Zapier Patched a Five-Flaw Chain That Could Have Hijacked Any Logged-In Account Aug 12, 2026](https://codekeeper.co/ticker/zapier-vulnerabilities-account-takeover-risks)