274 Zimbra Servers Down: Inside the CVE-2026-73570 Exploitation Wave and Why Patched NetScaler Bugs Keep Coming Back

The numbers coming out of this week's Help Net Security roundup deserve more attention than a single line in a digest. The Shadowserver Foundation has confirmed at least 274 internet-facing Zimbra server instances compromised through active exploitation of CVE-2026-73570. In the same window, researchers flagged renewed exploitation of a Citrix NetScaler vulnerability that organizations had already patched. Two different platforms, two different vendors, one shared lesson: the gap between disclosure, patching, and actual exploitation is where real damage happens, and that gap is getting exploited systematically rather than opportunistically.

What actually happened

Zimbra collaboration suites sit on the perimeter of a lot of mid-size and enterprise networks, exposing webmail and admin interfaces directly to the internet by design. That makes any remotely exploitable flaw in the platform immediately attractive to mass scanning operations. CVE-2026-73570 gave attackers exactly that kind of foothold, and Shadowserver's internet-wide telemetry caught the fallout in near real time: 274 distinct instances showing signs of compromise, a number that will almost certainly grow as the scanning data gets refined. This isn't a targeted intrusion against a handful of high-value organizations. It's the classic pattern of a scriptable exploit chain being run against every exposed instance an attacker's crawler can find, then sorting through the results afterward.

The Citrix NetScaler situation is arguably more concerning because it involves a flaw that was already patched. Attackers continuing to exploit a previously fixed vulnerability points to one of two realities: a large population of NetScaler appliances that never received the patch, or a bypass/variant of the original fix that researchers haven't fully mapped yet. Either explanation should worry defenders, because NetScaler appliances are frequently the load-balancing and VPN gateway layer for enterprise networks, meaning compromise there tends to translate directly into deeper network access rather than just a single defaced or ransomed box.

Why this matters beyond the headline count

The throughline here is that internet-facing infrastructure with known, patched vulnerabilities remains a productive attack surface months or years after a CVE is published. Shadowserver's kind of mass telemetry work exists precisely because scanning-based exploitation at scale is now routine tradecraft, not an edge case. When 274 Zimbra servers get popped through one CVE, it's a strong signal that patch adoption for perimeter groupware and collaboration platforms lags badly behind the threat timeline. The same applies to NetScaler: a fixed vulnerability being actively re-exploited means somewhere between the vendor's advisory and the administrator's change window, things are falling through.

This also intersects with a broader pattern security teams have been tracking all year, where ransomware crews and access brokers treat edge appliances as a commodity entry point. Get a working exploit for a widely deployed perimeter product, run it against the entire internet, and sell or use whatever access results. The Rhysida group's continued activity against government targets, mentioned elsewhere in this week's coverage, fits the same operational model: opportunistic initial access followed by targeted follow-through.

What defenders should actually do

First, inventory. If your organization runs Zimbra or NetScaler anywhere internet-facing, confirm patch status against CVE-2026-73570 and the relevant NetScaler advisory immediately rather than assuming last quarter's patch cycle covered it. Second, treat Shadowserver-style scan data as actionable threat intelligence, not just a statistic; if your IP ranges show up in that kind of dataset, assume compromise until proven otherwise and pull logs accordingly. Third, for any perimeter appliance with a history of exploitation, don't stop at patching, hunt for indicators of prior compromise, since attackers who got in before a patch landed don't necessarily lose access once it does. The uncomfortable truth in both stories is the same: patching is necessary but it is not the finish line, and the exploitation clock on perimeter software rarely resets to zero just because a fix shipped.