{"uuid": "0b86db69-8f95-435d-b9fc-6d7cf1610a6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73570", "type": "seen", "source": "https://infosec.exchange/users/shadowserver/statuses/117150069132269604", "content": "Alert! Zimbra compromises associated with CVE-2026-73570 exploitation are spreading. 274 instances seen compromised in our scans for exploitation artifacts on 2026-08-22. Top: US (41 IPs). Detection in collaboration with @CERT_Polska_en \nPublic Dashboard: https://dashboard.shadowserver.org/statistics/combined/map/?date_range=1&map_type=std&source=compromised_website&source=compromised_website6&tag=zimbra-compromised%2B&data_set=count&scale=log&auto_update=on\nData in Compromised Website reporting tagged 'zimbra-compromised' with detail set to 'Artifact from probable CVE-2026-73570 compromise' https://www.shadowserver.org/what-we-do/network-reporting/compromised-website-report/\nCompromised Zimbra tracker: https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=compromised_website&source=compromised_website6&tag=zimbra-compromised%2B&dataset=unique_ips&limit=100&group_by=geo&stacking=stacked&auto_update=on\nWe also see at least 8200 CVE-2026-73570 unpatched instances (note this does not mean exploitable as the vuln is in a non default config) https://dashboard.shadowserver.org/statistics/combined/tree/?date_range=1&source=http_vulnerable&source=http_vulnerable6&tag=possible-cve-2026-73570%2B&data_set=count&scale=log&auto_update=on\nCheck for compromise & update: https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories\nCVE-2026-73570 is on CISA KEV https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570\n#CyberCivilDefense", "creation_timestamp": "2026-08-24T10:43:14.735869Z"}