# Zimbra vulnerabilities & exploitation **CISA KEV** > As of 2026-10-12, Threadlinqs tracks 5 Zimbra CVEs, 2 in the CISA Known Exploited Vulnerabilities catalog, linked to 9 tracked threat campaigns and 2 named threat actors. **Data as of:** 2026-10-12 ## Exploitation timeline Threadlinqs has recorded 5 Zimbra CVEs published between 2024-08-15 and 2026-10-15. The busiest month was 2026-10 (3 new CVEs). 2 of them (40%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked Zimbra CVEs. - [CVE-2026-73570](https://intel.threadlinqs.com/cve/CVE-2026-73570) — HIGH 8.9 · KEV · EPSS 71.7% · 2026-08-13 - [CVE-2024-27443](https://intel.threadlinqs.com/cve/CVE-2024-27443) — MEDIUM 6.1 · KEV · EPSS 23.6% · 2024-08-12 - [CVE-2026-50055](https://intel.threadlinqs.com/cve/CVE-2026-50055) — MEDIUM 6.5 · EPSS 0.3% · 2026-10-08 - [CVE-2026-10631](https://intel.threadlinqs.com/cve/CVE-2026-10631) — MEDIUM 6.5 · EPSS 0.2% · 2026-10-08 - [CVE-2026-50054](https://intel.threadlinqs.com/cve/CVE-2026-50054) — HIGH 7.1 · EPSS 0.2% · 2026-10-08 ## Products affected Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 2 distinct Zimbra products are affected. The most frequently affected: - Collaboration Suite — 3 CVEs - Collaboration — 2 CVEs ## Threat activity 9 tracked threat campaigns reference Zimbra products or exploit Zimbra CVEs: - [Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injection](https://intel.threadlinqs.com/threat/TL-2026-2082) — CRITICAL — 2026-08-20 - [Operation RoundPress: TA458 Deploys SpyPress Malware via Half-Click Webmail Zero-Days (CVE-2025-27915, CVE-2025-3929, CVE-2026-8496)](https://intel.threadlinqs.com/threat/TL-2026-2579) — CRITICAL — 2026-07-23 - [Zimbra Collaboration Suite 10.1.20 Patches Critical Unauthenticated SNMP/Swatchdog Command Injection Plus Six Additional CVEs](https://intel.threadlinqs.com/threat/TL-2026-1586) — CRITICAL — 2026-07-21 - [Zimbra Collaboration Suite Classic Web Client Stored XSS (patched in 10.1.19, no CVE yet)](https://intel.threadlinqs.com/threat/TL-2026-1208) — CRITICAL — 2026-07-11 - [StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike](https://intel.threadlinqs.com/threat/TL-2026-1237) — HIGH — 2026-07-11 - [Zimbra Collaboration Suite Critical Stored XSS in Classic Web Client (Patched in ZCS 10.1.19)](https://intel.threadlinqs.com/threat/TL-2026-1176) — CRITICAL — 2026-07-10 - [SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt Strike](https://intel.threadlinqs.com/threat/TL-2026-1101) — HIGH — 2026-07-03 - [Zimbra Collaboration Suite Stored XSS via CSS @import Active Exploitation (CVE-2025-66376) — Operation GhostMail](https://intel.threadlinqs.com/threat/TL-2026-0266) — CRITICAL — 2026-03-21 - [APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine & EU (2024-2026 New TTPs)](https://intel.threadlinqs.com/threat/TL-2026-0066) — HIGH — 2026-02-12 ## Threat actors targeting Zimbra Named threat actors attributed to campaigns that involve Zimbra products or CVEs, with the number of linked campaigns: - [APT28](https://intel.threadlinqs.com/actor/APT28) — 2 campaigns - [StrikeShark](https://intel.threadlinqs.com/actor/StrikeShark) — 2 campaigns ## How to prioritise Zimbra patching This order follows the data Threadlinqs holds for Zimbra, not a generic severity checklist: - 2 of 5 Zimbra CVEs (40%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2026-73570](https://intel.threadlinqs.com/cve/CVE-2026-73570), [CVE-2024-27443](https://intel.threadlinqs.com/cve/CVE-2024-27443). - Outside KEV, the highest EPSS scores are [CVE-2026-50055](https://intel.threadlinqs.com/cve/CVE-2026-50055) (0.3%), [CVE-2026-10631](https://intel.threadlinqs.com/cve/CVE-2026-10631) (0.2%), [CVE-2026-50054](https://intel.threadlinqs.com/cve/CVE-2026-50054) (0.2%). - 0 CVEs score Critical and 2 High on CVSS v3 (maximum 8.9, average 7); sequence these after KEV and high-EPSS items. - 3 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-12 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/zimbra All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp