Critical Zimbra RCE Vulnerability Actively Exploited in the Wild
A critical remote code execution vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite is being actively exploited by threat actors, allowing unauthenticated attackers to execute arbitrary OS commands.
CERT Polska has issued a warning that threat actors are actively exploiting a critical remote code execution vulnerability within the Zimbra Collaboration Suite. The flaw, identified as CVE-2026-73570, permits unauthenticated attackers to execute arbitrary operating system commands with the privileges of the 'zimbra' user on compromised servers.
The vulnerability stems from an OS command injection flaw present in Zimbra's SNMP monitoring functionality. Its exploitation is contingent on specific configurations: the optional zimbra-snmp package must be installed, SNMP notifications must be enabled via the snmp_notify parameter, and the swatchdog service, which is enabled by default, must be running. This default configuration significantly increases the risk for organizations that have enabled SNMP trap notifications.
Attackers can leverage this vulnerability by sending specially crafted SMTP requests. These requests exploit improper input sanitization during the processing of SNMP notifications. The lack of authentication requirement makes this a particularly dangerous threat, as successful exploitation can lead to the execution of arbitrary shell commands. This level of access could be used by attackers to deploy web shells, exfiltrate sensitive mailbox data, alter server configurations, establish persistent footholds, or utilize the compromised mail server as a pivot point for further network intrusions.
Zimbra has addressed CVE-2026-73570 by releasing version 10.1.20 on July 20, 2026. The vendor's official security advisory confirms that this update effectively mitigates the command injection vulnerability within the SNMP monitoring component when notifications are active. Given that exploitation has already been observed in the wild, organizations running earlier versions of Zimbra Collaboration Suite are strongly urged to treat this vulnerability as an urgent patching priority.
CERT Polska has provided detection guidance for security teams investigating potential compromises. Administrators are advised to scrutinize Zimbra's log files, specifically /var/log/zimbra.log, for suspicious service-status messages. Anomalies such as unknown or malicious payloads changing their status from stopped to running, or vice versa, could indicate that an attacker has successfully exploited the vulnerable notification flow to manipulate processes.
Further forensic investigation should involve reviewing files created by the 'zimbra' user within the last 30 days. Key directories to examine include /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/. The presence of unexpected JSP files, executable scripts, archives, or recently modified application content in these locations may point to the staging or persistence of attacker payloads.
Organizations are strongly recommended to immediately identify all Zimbra Collaboration Suite servers within their environment. They should verify whether SNMP notifications are currently enabled and, if so, proceed with upgrading vulnerable systems to version 10.1.20 or a later patched release without delay. As an interim measure for environments where immediate patching is not feasible, disabling unnecessary SNMP notification functionality and closely monitoring SMTP traffic, Zimbra logs, process creation, and file system changes associated with the 'zimbra' account are critical mitigation steps.
Any suspected exploitation of this vulnerability should be treated as a potential full compromise of the mail server. Incident response protocols should be initiated, including preserving logs, isolating affected hosts, rotating credentials, reviewing mailbox access logs, and conducting a thorough investigation to understand the full scope of the breach and prevent further damage.
CERT Polska has confirmed that threat actors are actively exploiting CVE-2026-73570 in the wild. This command injection vulnerability, which carries a CVSS score of 8.9, allows for unauthenticated remote code execution and has since been patched by Zimbra.
Poland's CERT Polska has observed this campaign targeting the widely used email and collaboration platform, sharing some indicators of compromise. While the threat actor and their specific motivations remain unclear, the vulnerability allows for full control of a targeted Zimbra server, enabling persistence, credential harvesting, and lateral movement.
CISA has officially added CVE-2026-73570, an OS command injection vulnerability affecting Zimbra Collaboration Suite (ZCS), to its Known Exploited Vulnerabilities (KEV) Catalog. This directive mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize patching this vulnerability on publicly exposed assets due to confirmed evidence of active exploitation. The addition underscores CISA's ongoing efforts to promote risk-based vulnerability management across all organizations.
The Shadowserver Foundation has reported that at least 274 internet-facing Zimbra Collaboration Suite (ZCS) instances have been compromised by unknown attackers exploiting CVE-2026-73570. This new report indicates a significant increase in the number of affected servers since previous disclosures, highlighting the ongoing risk to organizations that have not yet applied the patch released by Synacor on July 20, 2026.
The new article reports that at least 274 internet-facing Zimbra servers have been compromised by attackers exploiting CVE-2026-73570. This widespread exploitation, detailed by the Shadowserver Foundation, highlights the active threat against unpatched Zimbra instances. The article also briefly mentions AI supply chain risks in developer workflows.