Zimbra Users Urgently Warned: Critical Flaw Is Being Actively Exploited
Zimbra Collaboration before 10.1.20 is actively exploited via CVE-2026-73570, an unauthenticated command-injection flaw. Patch now and check for compromise.
Zimbra Users Urgently Warned: Critical Flaw Is Being Actively Exploited
A newly urgent warning is circulating for organizations running Zimbra Collaboration Suite (ZCS): attackers are actively exploiting CVE-2026-73570, a command-injection vulnerability that can allow unauthenticated remote code execution under specific configurations. The issue affects Zimbra Collaboration versions before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
The risk is no longer theoretical. CERT Polska reported active exploitation, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. Administrators should treat exposed, affected systems as an urgent patching and incident-response priority.
What is CVE-2026-73570?
CVE-2026-73570 is an OS command-injection vulnerability in Zimbra Collaboration’s SNMP notification processing. According to the vulnerability description, insufficient sanitization of untrusted input can allow an unauthenticated attacker to send specially crafted SMTP requests that result in arbitrary operating-system commands being executed as the zimbra user.
The vulnerability is particularly relevant to deployments where two conditions are present:
- The optional
zimbra-snmppackage is installed. - SNMP notifications are enabled.
Affected Zimbra Collaboration versions are those before 10.1.20. The vulnerability has been assigned a CVSS v3.1 score of 8.9 by MITRE, indicating high severity. NVD
Why the warning is urgent
A patch being available does not remove the danger for servers that remain unpatched. Active exploitation means attackers have moved beyond vulnerability research and are attempting to compromise real-world systems.
CERT Polska reported exploitation activity, while CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog on August 21, 2026. For organizations responsible for internet-facing Zimbra infrastructure, that combination is a strong signal to prioritize remediation immediately. CERT Polska
Successful exploitation could give an attacker the ability to execute commands on the server as the Zimbra service account. Depending on the environment and follow-on access, a compromise could lead to mailbox access, credential theft, persistence, data theft, or lateral movement.
The first steps Zimbra administrators should take
1. Identify affected servers
Confirm the Zimbra version running on every server and determine whether the optional zimbra-snmp package is installed and SNMP notifications are enabled. Do not assume that a server is safe simply because it is not a primary mail node.
2. Update to a patched release
Zimbra released version 10.1.20 with a fix for the SNMP vulnerability. Update affected systems to the vendor-supported patched version as quickly as your change-control process allows. If an immediate upgrade is impossible, follow the vendor’s official mitigation guidance and reduce exposure while planning the update. Zimbra Security Advisories
3. Check for signs of compromise
Because exploitation has already been observed, patching alone may not be enough for a system that was exposed before remediation. Review logs and investigate suspicious activity.
CERT Polska advised administrators to look for unusual Zimbra service restarts and for suspicious files created by the zimbra user in locations including:
/opt/zimbra/jetty/webapps//opt/zimbra/jetty_base/webapps//tmp/
The presence of a file is not, by itself, proof of compromise. Administrators should investigate unexpected files, processes, network connections, scheduled tasks, and account changes using their normal incident-response procedures.
4. Preserve evidence before destructive cleanup
If compromise is suspected, preserve relevant logs and system evidence before deleting suspicious artifacts or rebuilding services. An organization may need those records to determine the initial access path, the scope of the intrusion, and whether credentials or data were affected.
5. Review credentials and access
If an attacker may have accessed the server, review administrator accounts, service credentials, authentication tokens, SSH keys, forwarding rules, and other persistence mechanisms. Rotate credentials where risk assessment indicates they may have been exposed.
A practical response checklist
- Verify the installed Zimbra version.
- Check whether
zimbra-snmpis installed. - Confirm whether SNMP notifications are enabled.
- Patch affected servers to Zimbra 10.1.20 or a later vendor-supported fixed release.
- Review logs for suspicious SMTP activity and unexpected service behavior.
- Investigate recently created or modified files in relevant Zimbra and temporary directories.
- Look for persistence, credential theft, or unauthorized account changes.
- Preserve evidence and escalate suspected incidents to the security team.
Who is most at risk?
The highest-priority systems are internet-exposed Zimbra deployments that meet the affected configuration conditions and have not been updated to a fixed version. However, internal-only servers should not be ignored: exposure can change through misconfiguration, VPN access, compromised internal hosts, or network pivoting.
Organizations using Zimbra for business, government, education, or other sensitive communications should include this vulnerability in their current vulnerability-management and incident-response review.
Frequently Asked Questions
Is CVE-2026-73570 actively exploited?
Yes. CERT Polska reported active exploitation, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. CISA Known Exploited Vulnerabilities Catalog
Which Zimbra versions are affected?
Zimbra Collaboration versions before 10.1.20 are affected when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
Does the attacker need an account?
The published vulnerability description states that exploitation can be performed without authentication under the affected configuration.
Is updating enough?
Updating removes the known vulnerable condition in the patched release, but an already compromised server may require additional investigation and incident response.
Bottom line
Zimbra administrators should not treat CVE-2026-73570 as a routine patch. The vulnerability has been reported as actively exploited, and affected systems can face unauthenticated remote command execution under the vulnerable SNMP configuration. Verify your exposure, update to a fixed release, and investigate systems that may have been reachable before remediation.
Source note: Technical details and exploitation status should be verified against Zimbra’s security information, NVD, CERT/CSIRT advisories, and CISA’s KEV catalog before publication.
