Act
active
Zimbra SNMP Command Injection CVE-2026-73570 Exploited in Wild
- Engineer — Act: Active exploitation confirmed by CERT Polska plus a public PoC on GitHub makes this urgent regardless of the low EPSS score. Patch Zimbra Collaboration (ZCS) to the fixed release immediately; prioritize any internet-facing Zimbra instances.
- SOC/IR — Act: Active in-the-wild exploitation of an email server RCE creates an assume-breach exposure window. Hunt Zimbra SNMP and application logs for anomalous command execution patterns since the PoC publication date, and pull any IOCs published by CERT Polska for sweeping.
- Leader — Skip
- Signals: CVE-2026-73570 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.