Your Email Server Is on the Attack List: Zimbra CVE-2026-73570 Joins CISA KEV

Email servers rarely make security headlines the way firewalls and VPNs do. They sit in the background, handling traffic, and security teams tend to assume that because email has been working for twenty years, it is being looked after by someone. CVE-2026-73570 in Zimbra Collaboration Suite is a reminder of what happens when that assumption goes unchallenged.

CISA added CVE-2026-73570 to the Known Exploited Vulnerabilities catalog during the week of August 24, 2026. The designation means one thing: attackers are using this in the wild, against real targets, right now.

What the Vulnerability Actually Does

CVE-2026-73570 is an unauthenticated command injection in Zimbra Collaboration Suite’s SMTP notification path. When Zimbra is configured to send SNMP notifications (a common monitoring setup), an attacker can inject OS commands via a crafted SMTP request. No credentials required. No social engineering. A single network packet is enough.

The attack path is straightforward: the injected command executes with the privileges of the Zimbra process, which on most deployments runs with enough permission to read mail spools, extract credentials from configuration files, and establish persistent access. From there, lateral movement into the broader network is a well-understood technique.

The result is full server compromise on the machine handling your organization’s email: every message in the queue, every attachment, every internal communication that passed through that server.

Why Email Servers Are a Different Kind of Target

A VPN appliance or a firewall sits at the network perimeter and is (usually) treated as a high-value asset. Patch cadence is tighter, access is restricted, and security teams pay attention when advisories arrive.

Email servers occupy a different position. They are both internal infrastructure and internet-facing services. They handle sensitive communication, but they are often managed by IT generalists rather than security specialists. They are almost always in scope for vulnerability scanners but frequently excluded from the fast-track remediation queue because “email has always worked.”

Zimbra specifically is disproportionately deployed in the segment that NIS2 and DORA regulations target: mid-sized European organizations that run their own mail infrastructure rather than outsourcing to Microsoft 365 or Google Workspace. The EU public sector, healthcare, and financial services verticals all have significant Zimbra footprints.

The Exploitation Window Is Already Closed for Some

CISA’s KEV addition on August 24 was not the discovery of this vulnerability. By the time a CVE lands in KEV, exploitation is already confirmed and documented. The question is not whether it is being exploited; the question is whether your instance was already compromised before you found out about it.

The gap between when a KEV entry is added and when most organizations respond is measured in days to weeks. For organizations on monthly patch review cycles, the math is straightforward: if exploitation began before the KEV addition date, and your cycle runs on the first Monday of the month, you may be looking at three to four weeks of exposure on a system that handles every email your company sends.

What Exposure Actually Looks Like

If you run Zimbra, the immediate questions are:

Are SNMP notifications enabled? This is the configuration that activates the vulnerable code path. Check zmprov gc default zimbraSmtpSource and the SNMP notification settings in the admin console. If notifications are disabled, the attack surface is significantly reduced while you patch.

What version are you running? Synacor has released a patched version. If you are behind on Zimbra releases, the remediation is an upgrade, not a configuration change.

Is your Zimbra instance network-accessible from untrusted ranges? SMTP (port 25) is almost always internet-facing by definition. The SNMP notification path is triggered server-side, but understanding your perimeter helps scope the blast radius if you find indicators of compromise.

Do you have indicators of compromise to rule out? On a KEV-listed vulnerability with active exploitation, “patch and move on” is not sufficient. Before and after patching, check process trees spawned by Zimbra processes, review authentication logs for unusual access patterns, and look for new cron entries or startup scripts installed under the Zimbra user.

The Structural Problem This Exposes

CVE-2026-73570 is the third KEV entry in August 2026 that targets infrastructure components that organizations tend to treat as lower-priority than endpoint and perimeter devices. VMware vCenter (CVE-2026-59310), Microsoft SharePoint (CVE-2026-55040), and now Zimbra follow a consistent pattern: the systems most deeply embedded in an organization’s operations, and therefore most difficult to patch quickly, are exactly the systems attracting active exploitation.

This pattern has a structural cause. Patch prioritization frameworks built on CVSS scores treat a 9.8 RCE on a rarely-deployed product the same as a 7.5 RCE on infrastructure running in half the organizations in your sector. CVSS measures severity; it does not measure how many attackers are looking for this exact vulnerability in this exact configuration right now. The KEV catalog provides that second dimension.

For organizations under NIS2, the calculus has a regulatory dimension as well. Article 21 of NIS2 requires “essential” and “important” entities to implement vulnerability handling procedures proportionate to the risk. Regulators have been clear in published guidance that proportionality is measured against real-world threat intelligence, not theoretical severity scores. A vulnerability in CISA’s KEV catalog, with confirmed active exploitation, is definitionally high-priority under NIS2. “We did not know” is not a defensible position when the information is publicly available.

How SentriKat Addresses This Specifically

SentriKat watches for vulnerabilities confirmed as exploited. When CVE-2026-73570 was flagged on August 24, organizations using SentriKat received an alert scoped to their asset inventory: if Zimbra appears in your environment, the alert lands in your queue with context, not just the CVE number.

The difference between a list and actionable intelligence is scope. A weekly digest that lists every new KEV entry requires someone on your team to cross-reference against your asset inventory, look up the product, determine whether your version is affected, and prioritize against everything else in the queue. SentriKat does that cross-referencing automatically, so what arrives is: “you have three Zimbra instances, two are on affected versions, here is the patch.”

For EU SMEs operating without a dedicated security team, that scoping is the difference between acting on day one and acting on day fourteen.

What to Do Right Now

1. Determine whether you run Zimbra. This sounds obvious, but shadow IT and acquired infrastructure mean email servers are sometimes not on the official asset list.
2. Check whether SNMP notifications are enabled and disable them temporarily while you schedule the upgrade.
3. Upgrade to the patched Zimbra release. Check Zimbra’s security advisories page for the specific version.
4. Check for indicators of compromise. On a KEV-listed vulnerability, assume you may have been targeted and look for evidence before declaring yourself safe.
5. Verify your detection coverage. If this KEV addition surprised you, that is a signal about your vulnerability intelligence process, not just about this one CVE.

The CISA KEV catalog is public, updated in near-real time, and free to access. Every organization with internet-facing infrastructure should be tracking it. If you are not, CVE-2026-73570 is a reasonable prompt to start.

SentriKat tracks vulnerabilities confirmed as exploited and maps them onto your asset inventory, so you know within hours whether a newly exploited vulnerability affects your environment. For NIS2-regulated organizations in the EU, that speed is the difference between a managed response and a reportable incident. Start your free trial.