Zimbra

I'm Doug White.

We've got Fibonacci and the unhappy number, Hidden Sounds, Teams, Zimbra, IntraID, ZAI, Schrödinger's battery, Aaron Leyland, and more on the Security Weekly News.

We interrupt this program-

-to bring you-

Listeners save thirty percent on their pass with code ISW26-SWsavings at securityweekly.com/infosecworld2026.

All right.

Zimbra.

Uh, Zimbra Collection Suite, or ZCS, as a lot of people call it, is used by, according to them, hundreds of millions of people and thousands and thousands of organizations, and apparently there's a flaw which would allow unauthenticated attackers to gain code execution remotely by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled.

Our first story is already urgent enough that the deadline has technically come and gone.

CVE-2026-73570 is a Zimbra collaboration suite flaw involving improper sanitization of untrusted input during SNMP notification processing.

So in plain English...

A specially crafted SMTP request triggers command injections in the SNMP monitoring component.

as of the time we record this shadow server still tracking more than 12 000 zimbra servers still exposed online the fix is zimbra collaboration suite 10.1.20 released back on july 20th which means this was patchable for a full month before exploitation began so if you haven't updated Do it today.

After patching, you should go through your logs.

Look for unexpected Zimbra service restarts and audit file creation over the past 30 days in a slash opt slash Zimbra slash Jetty slash web apps.

Jetty underscore is a base slash web apps and slash TMP.

I'm Doug White.

We've got Fibonacci and the unhappy number, Hidden Sounds, Teams, Zimbra, IntraID, ZAI, Schrodinger's Battery, Aaron Leland, and more on the Security Weekly News.

It's the show that keeps you up to date on the latest security news twice a week.

Your trusted source for accurate security information and expert analysis.

Listeners save 30% on their pass with code ISW26-SWSAVINGS at securityweekly.com slash InfoSecWorld2026.

All right.

Zimbra.

Zimbra Collection Suite, or ZCS as a lot of people call it, is used by, according to them, hundreds of millions of people and thousands and thousands of organizations.

I'm Doug White.

We've got Fibonacci and the unhappy number, Hidden Sounds, Teams, Zimbra, IntraID, ZAI, Schrodinger's Battery, Aaron Leland, and more on the Security Weekly News.

It's the show that keeps you up to date on the latest security news twice a week.

Your trusted source for accurate security information and expert analysis.

Join us in Orlando, October 12th to 14th.

Listeners save 30% on their pass with code ISW26-SWSAVINGS at securityweekly.com slash InfoSecWorld2026.

All right, Zimbra.

Zimbra Collection Suite, or ZCS as a lot of people call it, is used by, according to them, hundreds of millions of people and thousands and thousands of organizations, and apparently does a flaw which would allow unauthenticated attackers to gain code execution remotely by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled.

I'm Doug White.

We've got Fibonacci and the unhappy number, Hidden Sounds, Teams, Zimbra, IntraID, ZAI, Schrodinger's Battery, Aaron Leland, and more on the Security Weekly News.

It's the show that keeps you up to date on the latest security news twice a week.

Your trusted source for accurate security information and expert analysis.

Listeners save 30% on their pass with code ISW26-SWSAVINGS at securityweekly.com slash InfoSecWorld2026.

All right.

Zimbra.

Zimbra Collection Suite, or ZCS as a lot of people call it, is used by, according to them, hundreds of millions of people and thousands and thousands of organizations.

Email infrastructure is facing its own set of threats.

Unpatched Zimbra servers are currently being targeted by attackers exploiting CVE twenty twenty-six seven three five zero.

Zimbra is a widely used email and collaboration platform, and the vulnerability allows unauthorized access with potential for lateral movement inside affected environments.

The lesson here is familiar.

Patch quickly, monitor for indicators of compromise, and review your email infrastructure for any lingering vulnerabilities.

Finally, strategic alliances and advanced security tooling are critical to addressing the scale and complexity of today's threats.

Whether it's integrating AI-driven security platforms or leveraging shared threat intelligence, organizations need to think beyond traditional boundaries.

So, what matters most today? First and foremost, immediate action is required to patch critical Oracle, Keycloak, and Zimbra vulnerabilities.

NextGov Cybersecurity reports the Treasury Department has launched a public-private task force to prepare finance for quantum-enabled threats, pushing the sector toward adopting quantum-resistant practices.

BleepingComputer notes CISA's emergency Zimbra patch mandate, likely accelerating patch cycles beyond government to vendors and partners.

GBHackers warns of thousands of WordPress admin accounts at risk due to MiniOrange SAML SSO flaws, a critical issue for organizations with distributed site management.

And Cyber Insider flags a governance red flag.

We'll get to it.

But we start where the urgency is highest, a zero-click remote code execution floor in Zimbra, with a three-day federal patch deadline from CISA and a Russian-linked threat actor behind the campaign.

That deadline tells you something.

CISA doesn't issue three-day windows for theoretical risks.

CSR added CVE-2025-66376 to its Known Exploited Vulnerabilities Catalogue this week, and as I mentioned, the patch deadline for US federal agencies is three days.

We've covered the known exploited vulnerabilities catalog many times on this show, going back to episode two in June, and that three-day window is, every time, the clearest possible signal that exploitation is happening at scale right now, not in a threat model, not in a proof-of-concept lab environment, now, in the wild.

The vulnerability itself is a zero-click remote code execution flaw in Zimbra Collaboration Suite.

Zero click means no user interaction is required.