The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to remediate a critical and actively exploited OS command injection vulnerability in Zimbra Collaboration Suite (ZCS), by August 24, 2026, after adding the flaw to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, tracked as CVE-2026-73570, affects Zimbra deployments where SNMP trap notifications are enabled through the snmp_notify parameter and the swatchdog service is running, allowing unauthenticated attackers to send specially crafted SMTP requests and execute arbitrary operating system commands as the Zimbra user. Zimbra patched the flaw in ZCS 10.1.20, released July 20, but CERT Polska subsequently confirmed exploitation in the wild, while Shadowserver identified more than 270 compromised Zimbra instances and continues to track over 12,000 Internet-exposed servers. Although exploitation does not initially provide root privileges, attackers could leverage Zimbra-level access to steal sensitive emails and authentication data, modify web application files, deploy web shells or malware, establish persistence, and launch phishing attacks from trusted infrastructure. CERT Polska recommends organizations immediately patch vulnerable systems and investigate for compromise by reviewing Zimbra logs for unexpected service changes or suspicious commands and examining recently created files in Zimbra web application and temporary directories. The exploitation reinforces the persistent targeting of Internet-facing Zimbra infrastructure, which has previously been exploited by Russian state-linked groups including APT28, APT29, and Winter Vivern for espionage, credential theft, and email collection. CTIX analysts urge any affected organizations to ensure they remediate this vulnerability as soon as possible to prevent future exploitation.