Hackers breached over 270 Zimbra servers in ongoing attacks

What happened

Threat actors are actively exploiting a high-severity remote code execution vulnerability in Zimbra Collaboration Suite, and the damage is already visible: more than 270 Zimbra instances have been compromised in what appears to be an ongoing campaign. The attacks are not theoretical or proof-of-concept — they are producing real intrusions at scale, with the number of affected servers still climbing as the operation continues.

This article covers what is known about the exploitation, which organizations face the most exposure, and what steps administrators running Zimbra environments should take right now. It is written for security engineers, sysadmins, and IT decision-makers who operate or oversee Zimbra deployments and need to assess their risk without wading through raw threat-intelligence feeds.

Attackers have breached more than 270 Zimbra Collaboration Suite servers by exploiting a high-severity vulnerability that allows remote code execution. The campaign is described as ongoing, meaning the number of compromised instances is a floor rather than a ceiling — new victims are likely being added as the exploitation continues. The attacks are not limited to a single region or sector, and the pace suggests automated or semi-automated targeting rather than slow, manual reconnaissance. The vulnerability targeted is in ZCS, the enterprise email and collaboration platform widely used by government agencies, universities, financial institutions, and private companies around the world.

How it works

The breadth of confirmed compromises — 270 servers — is significant because each Zimbra instance typically serves an entire organization's email and collaboration infrastructure, not just a single workstation. A successful intrusion gives attackers access to email archives, contact databases, calendar data, and potentially credentials stored or transmitted through the platform. The fact that exploitation is actively producing confirmed breaches, rather than just exploitation attempts, indicates that patches or mitigations are not yet widely applied across the exposed population.

Any organization running an unpatched or misconfigured version of Zimbra Collaboration Suite with internet-facing components is within the scope of this campaign. ZCS is deployed broadly across public-sector and enterprise environments, and many installations are exposed directly to the internet because email servers require external connectivity to function. Smaller organizations and those without dedicated security operations teams are particularly at risk, since they are less likely to have applied patches quickly or to have detected post-exploitation activity on their servers.

Why it matters

The risk extends beyond the primary Zimbra server itself. Once attackers gain remote code execution on a mail server, they can pivot to internal network segments, harvest credentials from email content, set up persistent backdoors, and exfiltrate sensitive communications. Organizations in regulated industries — healthcare, finance, government — face compounded exposure because a breach of email infrastructure can trigger mandatory disclosure obligations and regulatory consequences on top of the direct operational damage.

The immediate priority for any Zimbra administrator is to verify the patch status of every ZCS instance in their environment. If a patch addressing the remote code execution vulnerability is available from Zimbra, it should be applied without waiting for a scheduled maintenance window, given that active exploitation is already documented at scale. Administrators should also review server logs for signs of unusual process execution, unexpected outbound connections, or new files written to web-accessible directories, which are common indicators of post-exploitation activity following a remote code execution attack.

Beyond patching, organizations should consider temporarily restricting external access to Zimbra administration interfaces if those surfaces are not required for day-to-day operations. Network-level monitoring for anomalous traffic originating from Zimbra servers — particularly connections to unfamiliar external hosts — can help identify servers that were compromised before patches were applied. Incident response teams should treat any Zimbra server as potentially compromised if it was internet-facing and unpatched during the window when active exploitation is known to have occurred.

Who is affected

Remote code execution vulnerabilities in web-based collaboration platforms like ZCS typically involve flaws that allow an attacker to send a crafted request to the server and cause it to execute attacker-controlled code without requiring valid credentials. In Zimbra's case, the platform runs a significant amount of Java-based server-side logic and exposes several endpoints to the internet, creating a wide surface area for this class of vulnerability. A high-severity rating indicates that exploitation is either unauthenticated or requires only minimal access, and that the impact reaches full system compromise rather than limited data exposure.

Once code execution is achieved, attackers commonly deploy web shells — small scripts written to a publicly accessible directory that allow persistent remote access through ordinary web requests. This technique is difficult to detect without file integrity monitoring or careful log analysis because the malicious files blend into a directory already filled with legitimate application files. The ongoing nature of the campaign suggests that attackers have a reliable, repeatable exploitation method, which is consistent with the vulnerability being publicly known or a working exploit being circulated within threat actor communities.

What to watch next

Several critical details about this campaign have not been publicly confirmed. The specific CVE identifier for the vulnerability being exploited has not been stated in the available information, making it difficult for defenders to cross-reference patch advisories with precision. It is also not publicly known which threat actor or actors are behind the campaign, whether this is a financially motivated operation, a state-sponsored effort, or multiple unrelated groups exploiting the same flaw simultaneously.

The full scope of the breach across all 270-plus compromised servers — what data was accessed, whether backdoors remain active, and how many organizations have detected the intrusion — is also uncharacterized in available reporting. The 270 figure represents confirmed compromises identified by researchers, but the actual number of affected servers is likely higher given that many organizations lack the monitoring capability to detect a server-side compromise in real time. Whether Zimbra has issued or plans to issue a formal security advisory with specific remediation guidance is not confirmed from the available source material.