{"id":1035,"date":"2026-08-24T15:07:12","date_gmt":"2026-08-24T12:07:12","guid":{"rendered":"https:\/\/www.tayfnews.tech\/tr\/?p=1035"},"modified":"2026-08-24T15:07:12","modified_gmt":"2026-08-24T12:07:12","slug":"cisadan-aktif-olarak-istismar-edilen-zimbra-collaboration-suite-acigi-icin-acil-yama-talimati","status":"publish","type":"post","link":"https:\/\/www.tayfnews.tech\/tr\/breaking-news\/cisadan-aktif-olarak-istismar-edilen-zimbra-collaboration-suite-acigi-icin-acil-yama-talimati\/","title":{"rendered":"CISA&#8217;dan Aktif Olarak \u0130stismar Edilen Zimbra Collaboration Suite A\u00e7\u0131\u011f\u0131 \u0130\u00e7in Acil Yama Talimat\u0131"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 counter-hierarchy ez-toc-counter ez-toc-transparent ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">\u0130\u00e7indekiler<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"\u0130\u00e7indekiler Tablosunu A\u00e7\/Kapat\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.tayfnews.tech\/tr\/breaking-news\/cisadan-aktif-olarak-istismar-edilen-zimbra-collaboration-suite-acigi-icin-acil-yama-talimati\/#CISA_Direktifi_ve_Guvenlik_Acigi_Detaylari\" >CISA Direktifi ve G\u00fcvenlik A\u00e7\u0131\u011f\u0131 Detaylar\u0131<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.tayfnews.tech\/tr\/breaking-news\/cisadan-aktif-olarak-istismar-edilen-zimbra-collaboration-suite-acigi-icin-acil-yama-talimati\/#Kesif_ve_Gercek_Dunyadaki_Istismar\" >Ke\u015fif ve Ger\u00e7ek D\u00fcnyadaki \u0130stismar<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.tayfnews.tech\/tr\/breaking-news\/cisadan-aktif-olarak-istismar-edilen-zimbra-collaboration-suite-acigi-icin-acil-yama-talimati\/#Baglam_ve_Zimbra_Yaziliminin_Onceki_Hedef_Alinmasi\" >Ba\u011flam ve Zimbra Yaz\u0131l\u0131m\u0131n\u0131n \u00d6nceki Hedef Al\u0131nmas\u0131<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.tayfnews.tech\/tr\/breaking-news\/cisadan-aktif-olarak-istismar-edilen-zimbra-collaboration-suite-acigi-icin-acil-yama-talimati\/#Sirada_Ne_Var\" >S\u0131rada Ne Var<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"CISA_Direktifi_ve_Guvenlik_Acigi_Detaylari\"><\/span>CISA Direktifi ve G\u00fcvenlik A\u00e7\u0131\u011f\u0131 Detaylar\u0131<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Siber G\u00fcvenlik ve Altyap\u0131 G\u00fcvenli\u011fi Ajans\u0131 (CISA), ABD Federal Sivil Y\u00fcr\u00fctme Organ\u0131 kurumlar\u0131na, Zimbra Collaboration Suite&#8217;i (ZCS) etkileyen ve aktif olarak istismar edilen bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131na kar\u015f\u0131 sistemlerini g\u00fcvence alt\u0131na almalar\u0131 y\u00f6n\u00fcnde resmi talimat verdi. CVE-2026-73570 olarak takip edilen g\u00fcvenlik a\u00e7\u0131\u011f\u0131, Zimbra g\u00fcvenlik ekibi taraf\u0131ndan 20 Temmuz&#8217;da yay\u0131nlanan 10.1.20 s\u00fcr\u00fcm\u00fcnde yamalanm\u0131\u015ft\u0131. Sorun, i\u015fbirli\u011fi yaz\u0131l\u0131m\u0131n\u0131n SNMP izleme bile\u015feninden kaynaklan\u0131yor.<\/p>\n<p>Bu zafiyetin ba\u015far\u0131l\u0131 bir \u015fekilde istismar edilmesi, kimli\u011fi do\u011frulanmam\u0131\u015f sald\u0131rganlar\u0131n hedef sistemlerde uzaktan kod \u00e7al\u0131\u015ft\u0131rmas\u0131na olanak tan\u0131yor. G\u00fcvenlik a\u00e7\u0131\u011f\u0131, \u00f6zellikle hedef sistemde SNMP bildirimleri etkinle\u015ftirildi\u011finde, SNMP bildirimi i\u015flenirken g\u00fcvenilmeyen girdilerin uygun \u015fekilde temizlenmemesinden kaynaklan\u0131yor. Kimli\u011fi do\u011frulanmam\u0131\u015f bir sald\u0131rgan, \u00f6zel olarak haz\u0131rlanm\u0131\u015f Basit Posta Aktar\u0131m Protokol\u00fc (SMTP) istekleri g\u00f6ndererek, Zimbra kullan\u0131c\u0131s\u0131 yetkileriyle herhangi bir i\u015fletim sistemi komutunun \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131na neden olabilir.<\/p>\n<p>Zimbra g\u00fcvenlik ekibi daha \u00f6nce 20 Temmuz&#8217;da yay\u0131nlanan 10.1.20 s\u00fcr\u00fcm\u00fcnde bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 gideren bir yaz\u0131l\u0131m g\u00fcncellemesi yay\u0131nlam\u0131\u015ft\u0131. Ancak daha sonra ger\u00e7ek d\u00fcnyada yap\u0131lan g\u00f6zlemler, g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131n devam eden kampanyalarda k\u00f6t\u00fc niyetli akt\u00f6rler taraf\u0131ndan aktif olarak hedef al\u0131nd\u0131\u011f\u0131n\u0131 do\u011frulad\u0131.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Kesif_ve_Gercek_Dunyadaki_Istismar\"><\/span>Ke\u015fif ve Ger\u00e7ek D\u00fcnyadaki \u0130stismar<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>CISA&#8217;n\u0131n uyar\u0131s\u0131, Polonya Bilgisayar Acil Durum M\u00fcdahale Ekibi CERT Polska&#8217;n\u0131n ge\u00e7en Pazartesi g\u00fcn\u00fc g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131n sahada hedef al\u0131nd\u0131\u011f\u0131n\u0131 ilk kez bildirmesinin ard\u0131ndan geldi. Cuma g\u00fcn\u00fc CISA, CERT Polska&#8217;n\u0131n uyar\u0131s\u0131n\u0131 do\u011frulad\u0131, kusuru Bilinen \u0130stismar Edilen G\u00fcvenlik A\u00e7\u0131klar\u0131 katalo\u011funa ekledi ve ABD Federal Sivil Y\u00fcr\u00fctme Organ\u0131 kurumlar\u0131na sistemlerini \u00fc\u00e7 g\u00fcn i\u00e7inde, 24 A\u011fustos&#8217;a kadar g\u00fcvence alt\u0131na almalar\u0131 talimat\u0131n\u0131 verdi.<\/p>\n<p>Ba\u011f\u0131ms\u0131z g\u00fcvenlik kurulu\u015flar\u0131 ve tehdit g\u00f6zlemcileri, yaz\u0131l\u0131m\u0131 \u00e7al\u0131\u015ft\u0131ran sunucular\u0131n yayg\u0131n maruziyetini ve potansiyel ele ge\u00e7irilmesini izledi. Tehdit g\u00fcvenli\u011fi g\u00f6zlemcisi Shadowserver internette a\u00e7\u0131kta kalan 12.000&#8217;den fazla Zimbra sunucusunu takip ederken, bunlar\u0131n ka\u00e7\u0131n\u0131n bal k\u00fcp\u00fc (honeypot) oldu\u011fu veya CVE-2026-73570 a\u00e7\u0131\u011f\u0131n\u0131 istismar eden sald\u0131r\u0131lara kar\u015f\u0131 halihaz\u0131rda g\u00fcvence alt\u0131na al\u0131nd\u0131\u011f\u0131 hakk\u0131nda hi\u00e7bir bilgi bulunmuyor.<\/p>\n<p>Pazartesi g\u00fcn\u00fc Shadowserver ayr\u0131ca CVE-2026-73570 istismar kal\u0131nt\u0131lar\u0131n\u0131 ararken 270&#8217;ten fazla ele ge\u00e7irilmi\u015f Zimbra Collaboration Suite \u00f6rne\u011fi buldu\u011funu belirtti. CISA devam eden bu sald\u0131r\u0131lar hakk\u0131nda herhangi bir bilgi payla\u015fmazken, Polonya CERT ekibi g\u00fcvenlik ekiplerinden, Zimbra servisinin beklenmedik bir \u015fekilde yeniden ba\u015flamas\u0131 gibi \u015f\u00fcpheli etkinlikler i\u00e7in loglar\u0131 ve belirli konumlarda olu\u015fturulan dosyalar\u0131 kontrol etmelerini istedi.<\/p>\n<ul>\n<li>Zimbra servisinin beklenmedik bir \u015fekilde yeniden ba\u015flamas\u0131 gibi \u015f\u00fcpheli etkinlikleri kontrol edin.<\/li>\n<li>Son 30 g\u00fcn i\u00e7inde zimbra kullan\u0131c\u0131s\u0131 taraf\u0131ndan <code>\/opt\/zimbra\/jetty\/webapps\/<\/code> klas\u00f6r\u00fcnde olu\u015fturulan dosyalar\u0131 aray\u0131n.<\/li>\n<li>Son 30 g\u00fcn i\u00e7inde zimbra kullan\u0131c\u0131s\u0131 taraf\u0131ndan olu\u015fturulan dosyalar i\u00e7in <code>\/opt\/zimbra\/jetty_base\/webapps\/<\/code> klas\u00f6r\u00fcn\u00fc inceleyin.<\/li>\n<li>Son 30 g\u00fcn i\u00e7inde zimbra kullan\u0131c\u0131s\u0131 taraf\u0131ndan olu\u015fturulan dosyalar i\u00e7in <code>\/tmp\/<\/code> klas\u00f6r\u00fcn\u00fc inceleyin.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Baglam_ve_Zimbra_Yaziliminin_Onceki_Hedef_Alinmasi\"><\/span>Ba\u011flam ve Zimbra Yaz\u0131l\u0131m\u0131n\u0131n \u00d6nceki Hedef Al\u0131nmas\u0131<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>ZCS, d\u00fcnya \u00e7ap\u0131nda y\u00fcz milyonlarca kurulu\u015f ve ki\u015fi taraf\u0131ndan kullan\u0131lan, y\u00fczlerce devlet kurumunu ve binlerce i\u015fletmeyi i\u00e7eren pop\u00fcler bir e-posta ve i\u015fbirli\u011fi paketidir. Zimbra g\u00fcvenlik sorunlar\u0131 sahada s\u0131kl\u0131kla hedef al\u0131nmakta olup son y\u0131llarda savunmas\u0131z e-posta sunucular\u0131ndan hassas verileri \u00e7almak i\u00e7in kullan\u0131lm\u0131\u015ft\u0131r.<\/p>\n<p>En son Seqrite Labs ara\u015ft\u0131rmac\u0131lar\u0131 Mart ay\u0131nda, Rusya&#8217;n\u0131n askeri istihbarat servisiyle ba\u011flant\u0131l\u0131 devlet destekli bir tehdit grubu olan APT28&#8217;in, Ukrayna h\u00fck\u00fcmetine ait ZCS sunucular\u0131n\u0131 hedef alan sald\u0131r\u0131larda sakl\u0131 siteler aras\u0131 betik \u00e7al\u0131\u015ft\u0131rma (XSS) a\u00e7\u0131\u011f\u0131n\u0131 istismar etti\u011fini ortaya koydu. Ekim 2024&#8217;te ABD ve \u0130ngiltere siber ajanslar\u0131, Midnight Blizzard ve Cozy Bear olarak izlenen ve Rusya D\u0131\u015f \u0130stihbarat Servisi ile ba\u011flant\u0131l\u0131 olan APT29 korsanlar\u0131n\u0131n, e-posta hesab\u0131 kimlik bilgilerini \u00e7almak i\u00e7in daha \u00f6nce istismar edilmi\u015f bir a\u00e7\u0131\u011f\u0131 kullanarak Zimbra sunucular\u0131n\u0131 hedef ald\u0131klar\u0131 konusunda uyard\u0131. Rus Winter Vivern siber casuslar\u0131 da NATO m\u00fcttefiki bireylere ve kurulu\u015flara ait e-postalar\u0131 Zimbra web posta portallar\u0131 \u00fczerinden \u00e7almak i\u00e7in yans\u0131tmal\u0131 Siteler Aras\u0131 Betik \u00c7al\u0131\u015ft\u0131rma (XSS) a\u00e7\u0131\u011f\u0131n\u0131 k\u00f6t\u00fcye kulland\u0131.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Sirada_Ne_Var\"><\/span>S\u0131rada Ne Var<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>ABD Federal Sivil Y\u00fcr\u00fctme Organ\u0131 kurumlar\u0131n\u0131n, CISA&#8217;n\u0131n zorunlu k\u0131ld\u0131\u011f\u0131 \u00fc\u00e7 g\u00fcnl\u00fck son tarihe uygun olarak CVE-2026-73570 g\u00fcvenlik a\u00e7\u0131\u011f\u0131 i\u00e7in yama veya azaltma i\u015flemlerini 24 A\u011fustos&#8217;a kadar tamamlamas\u0131 gerekmektedir.<\/p>\n<p><em>Kaynak: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw\/\" target=\"_blank\" rel=\"noopener noreferrer\">Orijinal Makale<\/a><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>CISA, federal kurumlara Zimbra Collaboration Suite&#8217;teki aktif olarak istismar edilen uzaktan kod \u00e7al\u0131\u015ft\u0131rma a\u00e7\u0131\u011f\u0131n\u0131 \u00fc\u00e7 g\u00fcn i\u00e7inde kapatmalar\u0131 talimat\u0131n\u0131 verdi.<\/p>\n","protected":false},"author":1,"featured_media":1034,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"googlesitekit_rrm_CAowrrDMDA:productID":"","tayfnews_source_url":"","footnotes":"","rank_math_focus_keyword":"Zimbra a\u00e7\u0131\u011f\u0131, CISA talimat\u0131, CVE-2026-73570, Zimbra g\u00fcvenlik a\u00e7\u0131\u011f\u0131, uzaktan kod \u00e7al\u0131\u015ft\u0131rma, Zimbra Collaboration Suite","rank_math_title":"CISA'dan Aktif Olarak \u0130stismar Edilen Zimbra Collaboration Suite A\u00e7\u0131\u011f\u0131 \u0130\u00e7in Acil Yama Talimat\u0131","rank_math_description":"CISA, federal kurumlara Zimbra Collaboration Suite'teki aktif olarak istismar edilen uzaktan kod \u00e7al\u0131\u015ft\u0131rma a\u00e7\u0131\u011f\u0131n\u0131 \u00fc\u00e7 g\u00fcn i\u00e7inde kapatmalar\u0131 talimat\u0131n\u0131 verdi."},"categories":[12],"tags":[],"class_list":["post-1035","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news"],"_links":{"self":[{"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/posts\/1035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/comments?post=1035"}],"version-history":[{"count":1,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/posts\/1035\/revisions"}],"predecessor-version":[{"id":1036,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/posts\/1035\/revisions\/1036"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/media\/1034"}],"wp:attachment":[{"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/media?parent=1035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/categories?post=1035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/tags?post=1035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}