Critical Zimbra RCE Vulnerability Actively Exploited in the Wild
A critical remote code execution vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite is being actively exploited by threat actors, allowing unauthenticated attackers to execute arbitrary OS commands.
CERT Polska has issued a warning that threat actors are actively exploiting a critical remote code execution vulnerability within the Zimbra Collaboration Suite. The flaw, identified as CVE-2026-73570, permits unauthenticated attackers to execute arbitrary operating system commands with the privileges of the 'zimbra' user on compromised servers.
The vulnerability stems from an OS command injection flaw present in Zimbra's SNMP monitoring functionality. Its exploitation is contingent on specific configurations: the optional zimbra-snmp package must be installed, SNMP notifications must be enabled via the snmp_notify parameter, and the swatchdog service, which is enabled by default, must be running. This default configuration significantly increases the risk for organizations that have enabled SNMP trap notifications.
Attackers can leverage this vulnerability by sending specially crafted SMTP requests. These requests exploit improper input sanitization during the processing of SNMP notifications. The lack of authentication requirement makes this a particularly dangerous threat, as successful exploitation can lead to the execution of arbitrary shell commands. This level of access could be used by attackers to deploy web shells, exfiltrate sensitive mailbox data, alter server configurations, establish persistent footholds, or utilize the compromised mail server as a pivot point for further network intrusions.
Zimbra has addressed CVE-2026-73570 by releasing version 10.1.20 on July 20, 2026. The vendor's official security advisory confirms that this update effectively mitigates the command injection vulnerability within the SNMP monitoring component when notifications are active. Given that exploitation has already been observed in the wild, organizations running earlier versions of Zimbra Collaboration Suite are strongly urged to treat this vulnerability as an urgent patching priority.
CERT Polska has provided detection guidance for security teams investigating potential compromises. Administrators are advised to scrutinize Zimbra's log files, specifically /var/log/zimbra.log, for suspicious service-status messages. Anomalies such as unknown or malicious payloads changing their status from stopped to running, or vice versa, could indicate that an attacker has successfully exploited the vulnerable notification flow to manipulate processes.
Further forensic investigation should involve reviewing files created by the 'zimbra' user within the last 30 days. Key directories to examine include /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/. The presence of unexpected JSP files, executable scripts, archives, or recently modified application content in these locations may point to the staging or persistence of attacker payloads.
Organizations are strongly recommended to immediately identify all Zimbra Collaboration Suite servers within their environment. They should verify whether SNMP notifications are currently enabled and, if so, proceed with upgrading vulnerable systems to version 10.1.20 or a later patched release without delay. As an interim measure for environments where immediate patching is not feasible, disabling unnecessary SNMP notification functionality and closely monitoring SMTP traffic, Zimbra logs, process creation, and file system changes associated with the 'zimbra' account are critical mitigation steps.
Any suspected exploitation of this vulnerability should be treated as a potential full compromise of the mail server. Incident response protocols should be initiated, including preserving logs, isolating affected hosts, rotating credentials, reviewing mailbox access logs, and conducting a thorough investigation to understand the full scope of the breach and prevent further damage.