CISA Sets 3-Day Deadline to Patch Actively Exploited Zimbra Flaw CVE-2026-73570

CISA has added a critical Zimbra Collaboration Suite vulnerability—tracked as CVE-2026-73570—to its Known Exploited Vulnerabilities (KEV) catalog, ordering federal agencies to apply patches within an unusually aggressive three-day window. The flaw, which enables full takeover of a user's email communications, is already being weaponized by threat actors in the wild, raising alarm across both public and private sector security teams.

The vulnerability resides in Zimbra's email processing logic and allows an unauthenticated attacker to intercept and manipulate inbound and outbound messages without triggering user-facing warnings. Once exploited, adversaries gain persistent access to mailbox contents, credentials, and authentication tokens—a particularly dangerous capability given Zimbra's widespread deployment across government agencies, universities, and mid-market enterprises. Security researchers note that successful exploitation can bypass standard spam filters and maintain stealth for extended periods.

With CISA's Binding Operational Directive 22-01 mandating remediation by February 1, organizations running affected Zimbra 10.x builds are urged to inventory their instances and apply the vendor patch immediately. Security teams should also audit logs for indicators of compromise, paying close attention to anomalous authentication patterns and unexpected message-routing changes. Because the vulnerability potentially exposes stored credentials, administrators should enforce credential rotation across affected accounts and review mailbox rules for injected forwarding addresses.

Defenders are advised to bolster email security postures holistically while patches propagate. Use our password checker to identify compromised credentials before an attacker exploits harvested logins, and run our SSL/TLS checker to confirm mail server certificates remain valid and properly configured. Additionally, our email breach checker can help determine whether user accounts tied to Zimbra deployments have already appeared in known credential dumps, providing an early warning of follow-on intrusions.