CERT Polska confirmed on August 19, 2026 that attackers are actively exploiting CVE-2026-73570, a critical OS command injection flaw in Zimbra Collaboration Suite that gives unauthenticated attackers arbitrary shell command execution as the zimbra user.

The vulnerability carries a CVSS score of 8.9. Zimbra shipped the fix in version 10.1.20 on July 20, 2026 — a month before exploitation was confirmed in the wild.

The Flaw

The bug lives in Zimbra’s SNMP monitoring functionality. An attacker sends specially crafted SMTP requests that abuse improper input sanitization during SNMP notification processing. No authentication is required. Successful exploitation yields shell command execution with the privileges of the Zimbra service account — which on a mail server means the account that can read every mailbox on the box.

Exploitation depends on three conditions:

  1. The optional zimbra-snmp package is installed
  2. SNMP notifications are enabled via the snmp_notify parameter
  3. The swatchdog service is running

The third condition is the dangerous one. swatchdog is enabled by default, which means any organization that turned on SNMP trap notifications for monitoring — an entirely ordinary operational decision — satisfies the remaining requirement without having chosen anything unusual.

The attack path is worth naming precisely: a request arriving over SMTP reaches command injection in an SNMP code path. The monitoring subsystem is exposed through the mail-receiving subsystem. Anyone who scoped their risk by asking “is SNMP reachable from the internet?” asked the wrong question.

The Exposure

Internet scanning tracks more than 12,100 Zimbra servers exposed globally, concentrated in Asia (4,492) and Europe (4,382).

Not all of those are vulnerable — the SNMP package is optional and the exposed set includes patched instances. But Zimbra’s install base skews toward the organizations least equipped to patch a mail server inside 30 days: universities, regional government, healthcare, and national telecoms in markets where Microsoft 365 licensing is the cost being avoided.

Zimbra Is Not an Accident Target

CISA’s Known Exploited Vulnerabilities catalog already contains 18 Zimbra Collaboration Suite vulnerabilities, four of them added in 2026. That is not the profile of an incidentally popular product. Zimbra flaws have been used by APT29, APT28 and Winter Vivern — the mail server sits at the intersection of everything a state-sponsored collector wants: correspondence, calendars, contact graphs, and password-reset flows for every other system in the organization.

CVE-2026-73570 is not yet in the KEV catalog as of this writing, despite confirmed exploitation. Federal agencies working KEV as their patch queue have no deadline on this one. That gap — real exploitation preceding catalog listing — is a structural feature of KEV rather than an oversight, and it is the reason KEV should be a floor for prioritization rather than the definition of urgency.

What To Do

Patch to 10.1.20 or later. That is the fix. Everything below is for the interval before you get there and for finding out whether you are already too late.

Reduce the attack surface if you cannot patch immediately. Disable SNMP notifications by clearing snmp_notify, or remove the zimbra-snmp package on hosts that do not need it. Either breaks the exploit chain.

Hunt for post-exploitation artifacts covering the last 30 days. CERT Polska and Zimbra point at:

  • Unexpected Zimbra service restarts
  • Files created by the zimbra user in /opt/zimbra/jetty/webapps/
  • Files created by the zimbra user in /opt/zimbra/jetty_base/webapps/
  • Files created by the zimbra user in /tmp/

Webshells dropped into the Jetty webapp directories are the expected outcome — they survive the patch. A patched server with a webshell installed on August 10 is a compromised server running current code.

Assume mailbox access if you find evidence of exploitation. Command execution as zimbra means every message on that host should be treated as read, and every credential ever sent through it as exposed. Reset service account passwords, revoke sessions and API tokens, and review mail forwarding rules — mailbox rule manipulation is the standard persistence move after a Zimbra compromise.

Sources