456/69 Friday, August 21, 2026
CERT Polska has warned that CVE-2026-73570 in Zimbra Collaboration Suite (ZCS) is being exploited in attacks. The vulnerability was fixed in Zimbra version 10.1.20, released on July 20, 2026. The flaw is a command injection vulnerability in the SNMP Monitoring component and could allow unauthenticated attackers to execute commands on the system if SNMP notifications are enabled.
The vulnerability is caused by insufficient sanitization of untrusted input during SNMP notification processing. An attacker could send a specially crafted SMTP request, potentially leading to operating system command execution with the privileges of the zimbra user. Shadowserver has detected more than 12,100 Zimbra servers exposed to the internet, mostly in Europe and Asia. However, it has not been confirmed how many of these systems are honeypots or have already been patched.
Administrators using Zimbra should update to version 10.1.20 or another fixed version as soon as possible, especially on systems where SNMP notifications are enabled. They should also review logs and check for abnormal behavior, such as unexpected Zimbra service restarts. In addition, administrators should inspect files created by the zimbra user within the past 30 days in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/, as vulnerabilities in email servers are often used as an initial access point to reach email data and internal organizational systems.