Poland’s national cybersecurity team CERT Polska has warned organizations about active exploitation of a serious vulnerability in Zimbra Collaboration Suite, tracked as CVE-2026-73570.
The flaw affects Zimbra Collaboration installations before version 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Under those conditions, an unauthenticated attacker can send specially crafted SMTP requests that may lead to execution of operating system commands as the zimbra user.
What Happened
CERT Polska published an advisory on August 17, 2026, warning that CVE-2026-73570 is being actively exploited in the wild. The agency described the issue as an OS Command Injection vulnerability in Zimbra Collaboration Suite that allows an unauthenticated attacker to execute arbitrary shell commands with the privileges of the zimbra user.
Zimbra addressed the vulnerability in Zimbra Collaboration 10.1.20. Administrators running affected versions are advised to verify their installations and update immediately.
Although some reports describe the situation as a zero-day campaign, the most precise wording is that this is a recently patched vulnerability now under active exploitation. For organizations that have not updated, the practical risk is the same: internet-facing Zimbra servers may already be targeted.
How the Vulnerability Works
The vulnerability is tied to Zimbra’s SNMP notification processing.
NVD describes the issue as improper sanitization of untrusted input during SNMP notification processing. If the optional zimbra-snmp package is installed and SNMP notifications are enabled, a remote unauthenticated attacker can craft SMTP requests that trigger command execution.
The vulnerability is classified as CWE-78, which is OS command injection. This class of flaw is dangerous because attacker-controlled input can reach the operating system shell instead of being treated only as data.
In simple terms: a mail-related request can become a path to run commands on the server.
Why This Is Serious
Zimbra servers are high-value targets because they hold email, calendars, contacts, attachments, credentials, authentication tokens, and internal communications.
If attackers gain command execution on a Zimbra server, they may be able to:
- deploy web shells
- steal mailbox data
- collect credentials or tokens
- modify server files
- create persistence
- pivot deeper into the network
- monitor incoming and outgoing mail
- use the server as infrastructure for further attacks
Even though the command execution runs as the zimbra user rather than root, that is still a dangerous foothold. On an email server, the application user can often access valuable application data and may provide a path toward deeper compromise.
Who Is Affected
Organizations are at risk if they run:
- Zimbra Collaboration Suite before 10.1.20
- the optional zimbra-snmp package
- SNMP notifications enabled through
snmp_notify - the
swatchdogservice running, which CERT Polska notes is enabled by default in relevant configurations
Not every Zimbra server is vulnerable in the same way. The exploit conditions depend on the SNMP-related setup. However, administrators should not assume they are safe without verifying the installed version, enabled packages, and configuration.
What Administrators Should Check
CERT Polska recommends reviewing Zimbra logs for suspicious service status changes, especially entries similar to:
Service status change: <malicious payload> changed from stopped to running
Service status change: <malicious payload> changed from running to stoppedThe agency also recommends checking for files created by the zimbra user in the last 30 days in the following directories:
/opt/zimbra/jetty/webapps/
/opt/zimbra/jetty_base/webapps/
/tmp/These locations matter because attackers often use web-accessible application directories or temporary folders to stage payloads, web shells, scripts, or persistence mechanisms.
Recommended Response
Organizations running Zimbra should act quickly.
Priority actions:
- Update to Zimbra Collaboration 10.1.20 or later.
This is the version identified by CERT Polska as removing the vulnerability. - Verify whether
zimbra-snmpis installed.
If SNMP monitoring is not required, consider removing or disabling the component. - Check whether SNMP notifications are enabled.
Reviewsnmp_notifyand related monitoring configuration. - Review logs for signs of exploitation.
Focus on unusual service status changes, suspicious SMTP activity, and commands appearing inside log entries. - Inspect high-risk directories.
Look for recently created or modified files under Jetty webapp paths and/tmp. - Preserve evidence before cleanup.
If suspicious artifacts are found, collect logs, timestamps, file hashes, and copies of suspicious files before deletion. - Rotate credentials if compromise is suspected.
Include administrator accounts, mailbox credentials, API tokens, LDAP credentials, and any secrets stored on or accessible from the Zimbra host. - Review outbound connections.
Look for unusual connections from the Zimbra server to unknown IPs or domains. - Hunt for persistence.
Check cron jobs, systemd units, web shells, modified application files, SSH keys, and unexpected scripts. - Contact CERT or incident response support if exploitation is suspected.
CERT Polska specifically asks organizations to contact them if signs of exploitation are found.
Why Email Platforms Remain a Frequent Target
Email servers remain one of the most attractive targets for attackers.
They sit on the internet, process untrusted messages, hold sensitive communication, and often connect to authentication directories, archiving systems, mobile sync, and business workflows.
Zimbra has also been repeatedly targeted in recent years. BleepingComputer noted that Zimbra flaws have been used in previous campaigns against vulnerable email servers, including campaigns focused on stealing emails and credentials.
That history matters because attackers already understand the value of Zimbra environments. Once a new exploit path appears, scanning and exploitation can happen quickly.
Final Thoughts
CVE-2026-73570 is a serious reminder that email infrastructure must be treated as critical infrastructure.
The flaw allows unauthenticated command execution under specific Zimbra SNMP notification conditions, and CERT Polska has confirmed active exploitation attempts. Organizations running Zimbra should not wait for broader compromise reports before acting.
Patch immediately, verify SNMP exposure, inspect logs, review suspicious files, and assume that internet-facing unpatched systems may already have been probed.
For exposed collaboration servers, patching is only the first step. When exploitation is already active, administrators must also hunt for evidence of compromise.
