CISA puts an exploited Zimbra command-injection bug on the KEV list

CVE-2026-73570 is unauthenticated command injection in SNMP notification processing as the zimbra user. CERT Polska saw it in the wild. Federal agencies had to patch by August 24.

Cover image from BleepingComputer’s report on CISA’s Zimbra KEV order

On August 24 BleepingComputer reported that CISA added CVE-2026-73570 to the Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by August 24. CERT Polska had already seen the bug in the wild. Zimbra fixed it on July 20 in ZCS 10.1.20.

What we know

CVE-2026-73570 was added to CISA’s KEV list; federal agencies had a patch deadline of August 24.
CERT Polska reported in-the-wild exploitation.
The fix shipped July 20 in Zimbra Collaboration Suite 10.1.20.
The bug is unauthenticated command injection in SNMP notification processing and runs as the zimbra user; SNMP notifications must be on.
Shadowserver counted more than 12,000 exposed Zimbra servers and more than 270 with exploit artifacts.

Takeaways

The federal clock and the KEV listing landed on the same day as this report.
The injection is reachable only when SNMP notifications are enabled.
Hundreds of internet-facing servers already show exploit leftovers.

Source: BleepingComputer / CISA

Related reading

Image published with BleepingComputer on exploited Gitea CVE-2026-60004

SecurityAug 263 min read

CISA says attackers are exploiting a critical Gitea code-injection flaw

CISA says CVE-2026-60004 is being exploited on self-hosted Gitea: a critical code injection in the diffpatch API. Default open registration lets an unauthenticated visitor create an account and repository, then run commands as the gitea user.

Image published with SiliconANGLE on the Nvidia NemoClaw CVE-2026-65105 flaw

SecurityAug 253 min read

NemoClaw flaw let a malicious site poison a developer’s local Ollama model

Oasis Security’s CVE-2026-65105 says one visit to a malicious site can take control of the local Ollama instance behind Nvidia’s NemoClaw agent. Ollama binds on 0.0.0.0:11434, and the Host check is skipped when the bind address is not loopback.

Image published with BleepingComputer on npm and UNPKG phishing pages

SecurityAug 253 min read

Attackers abuse npm and UNPKG to host phishing redirect pages

OX Security found 24 npm packages that contain only malicious HTML impersonating a Cloudflare Turnstile check. UNPKG copied the files, so opening the HTML from the trusted mirror can redirect a visitor.

All of Pulse

SecurityAugust 24, 20263 min read

CISA puts an exploited Zimbra command-injection bug on the KEV list

CVE-2026-73570 is unauthenticated command injection in SNMP notification processing as the zimbra user. CERT Polska saw it in the wild. Federal agencies had to patch by August 24.

What we know

CVE-2026-73570 was added to CISA’s KEV list; federal agencies had a patch deadline of August 24.
CERT Polska reported in-the-wild exploitation.
The fix shipped July 20 in Zimbra Collaboration Suite 10.1.20.
The bug is unauthenticated command injection in SNMP notification processing and runs as the zimbra user; SNMP notifications must be on.
Shadowserver counted more than 12,000 exposed Zimbra servers and more than 270 with exploit artifacts.

Takeaways

The federal clock and the KEV listing landed on the same day as this report.
The injection is reachable only when SNMP notifications are enabled.
Hundreds of internet-facing servers already show exploit leftovers.

Source: BleepingComputer / CISA