Topic starter
30/07/2026 10:48 pm
TL;DR: Russian actors tracked as Laundry Bear are exploiting an unpatched Zimbra zero-day to steal email from US and Ukraine targets, according to Senserva, while KEV-listed flaws in ColdFusion, SharePoint, Exchange and Langflow reinforce that exposure management now matters more than patch volume. Internet-facing services with standing access turn delay into active compromise.
Editorial analysis by NHI Mgmt Group, based on content published by Senserva: “Russian Hackers Exploit Zimbra Zero-Day, ColdFusion Hits KEV”.
Key questions
Q: How should security teams respond when a zero-day is likely to have been exploited already?
A: Treat the issue as an active containment event, not just a patching task.
Q: Why do exploited internet-facing services move ahead of other critical patches?
A: Because exposure and active use collapse the time available for defense.
Q: What are the signs that a mail server exploit has already affected the environment?
A: Look for new forwarding rules, abnormal mailbox access, unfamiliar delegated permissions, and sign-ins that do not fit normal user behaviour.
Practitioner guidance
- Prioritise active exploitation over severity scores Move any KEV-listed or publicly exploited flaw ahead of routine patch queues, especially when the affected service is internet-facing.
- Hunt for mailbox abuse after mail server compromise Review forwarding rules, delegated mailbox access, unusual sign-ins, and unexplained changes to mail routing on affected Zimbra or similar systems.
- Confirm exposure on all internet-facing collaboration systems Verify the current build and patch state of Zimbra, SharePoint, Exchange, ColdFusion, and other externally reachable services before the next maintenance window.
Bottom line: Active exploitation changes the risk equation because public services with trusted access can be turned into compromise paths before routine patch cycles catch up.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:56 pm
Active exploitation, not vulnerability count, should set patch priority. The central governance error in many remediation programmes is treating all critical flaws as if they were equally urgent. Once a weakness is confirmed in the wild, the relevant question becomes whether the exposed service can still be reached, abused, or chained into account compromise. Practitioners should treat exploitation evidence as the decisive triage input.
A few things that frame the scale:
- Only 26% of known exploited vulnerabilities were fully remediated in 2025, down from 38% the year before, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should security teams decide whether to patch KEV-listed flaws or investigate exposure first?
A: Use both. If a vulnerability is in KEV and the asset is internet-facing, patching and exposure review should happen together because the asset may already be under attack. Investigation comes first only when evidence suggests the system is actively compromised and containment is needed before change work.
👉 Read our full editorial: Active exploitation of Zimbra and KEV flaws is driving patch priority