- Engineer — Act: CISA KEV-listed, public PoC active, CVSS 8.9 unauthenticated RCE via SNMP path — patch Zimbra Collaboration Suite to the vendor-released fixed version immediately and audit Zimbra webroot directories for newly created or modified web shell files.
- SOC/IR — Act: Active exploitation confirmed with web shell staging and authentication secret harvesting; hunt for unexpected child processes spawned from the Zimbra service account since late September and sweep Zimbra webroot paths for recently written .jsp/.php files indicative of web shell deployment.
- Leader — Act: CISA KEV listing for an unauthenticated RCE in a widely-deployed enterprise mail platform with confirmed credential harvesting — confirm whether Zimbra is in your environment, verify patching status with the infrastructure team, and assess whether harvested mailbox credentials could expose sensitive communications or escalate to broader account compromise.
- Signals: CVE-2026-73570 — CISA KEV: listed, EPSS 0.12, public PoC on GitHub, reported by 2 collected sources