Skip to main content
AdvisorySeverity: Critical

Security Advisory: Zimbra Email Vulnerabilities

NC4 urges organizations in Kenya using Zimbra Collaboration to urgently address security vulnerabilities, apply available patches, investigate potential compromise and migrate unsupported systems to secure, maintained versions.

Audience focus:
  • Government & counties
  • Small & medium businesses
  • Critical infrastructure

The National Computer and Cybercrimes Coordination Committee (NC4) advises all organizations in Kenya using Zimbra Collaboration to urgently review and secure their email infrastructure.

Security vulnerabilities, including CVE-2024-45519 and CVE-2026-73570, may expose affected systems to unauthorized command execution, data breaches and service disruption. Organizations operating outdated or unsupported Zimbra versions face additional security risks.

Recommended Actions

  • Identify all Zimbra installations and affected versions.

  • Apply the latest applicable security patches.

  • Investigate suspicious activity and signs of compromise.

  • Strengthen authentication and restrict unnecessary services.

  • Migrate unsupported installations to maintained versions.

Important: Applying security patches does not automatically remove an existing compromise. Affected organizations should investigate and preserve relevant digital evidence.

Organizations are encouraged to report suspected cybersecurity incidents to NC4.


Affected products

  • ZIMBRA MAIL

    Think you have been affected?

    Report the incident to NC4. We can help with containment, investigation and recovery, and your report helps us warn others.
    Return focus to the top of the page
    Chat with NC4