274 Zimbra servers already breached as unpatched RCE exploitation spreads
Shadowserver's scans count 274 Zimbra instances already compromised via CVE-2026-73570, an unauthenticated command-injection RCE in the SNMP component that Synacor patched in ZCS 10.1.20. CERT Polska flagged the in-the-wild abuse first; CISA has since added the flaw to KEV and given federal agencies three days to patch. The same scan also found at least 8,200 exposed, unpatched instances still sitting in the blast radius.