🛡️ **CRITICAL: Russian State Actors Actively Exploiting Zimbra RCE — Immediate Patch Required**
Published Thursday, August 20, 2026 at 04:45 AM PT BLUF Russian state-backed group “Laundry Bear” is actively exploiting a critical remote code execution vulnerability in Zimbra Collaboration Suite. Malicious code embedded in crafted emails executes in user sessions. All unpatched ZCS deployments are compromised. Patch immediately; treat as active intrusion risk. DETAILS Vulnerability: Critical RCE flaw in Zimbra Collaboration Suite allows arbitrary code execution via specially crafted emails; executes in user session context. Active Exploitation: Russian state actors (identified as “Laundry Bear”) confirmed conducting phishing campaigns against Western government and critical infrastructure targets. Pass-the-cookie techniques documented for session hijacking and persistence. Affected Scope: All Zimbra Collaboration Suite deployments without current patches. Vulnerability described as zero-day/zero-click variant in some reporting. Confirmed Attacks: High-volume successful intrusions documented. CISA has issued formal alerts. Multiple independent sources (BleepingComputer, SecurityWeek, The Hacker News, Help Net Security, Industrial Cyber) confirm active exploitation in the wild. Attack Path: Phishing + malicious email → RCE → session hijacking → lateral movement and data theft. IMPACT ...