CERT Polska is warning that attackers are actively exploiting an unauthenticated command-injection bug in Zimbra's SNMP monitoring component — one Zimbra quietly fixed five weeks ago, in version 10.1.20.
Zimbra fixed CVE-2026-73570 on July 20, folded quietly into version 10.1.20 of Zimbra Collaboration Suite. Five weeks later, Poland's CERT Polska is warning that attackers are actively using it to break into mail servers that never got the update — an unauthenticated bug that lets them run operating-system commands as the Zimbra user, no password required.
The bug sits in a part of Zimbra most admins forget exists: the optional zimbra-snmp package, and specifically the notification handling behind the snmp_notify setting. Feed it a crafted SMTP request and, because that input isn't sanitized before it reaches a shell command, an attacker gets arbitrary code execution — 8.9 on the CVSS scale, unauthenticated, over the network, the same no-login pattern that made Cisco's IMC root bug and the N-able N-central flaw Storm-1175 rode in on so dangerous this year. The watchdog service that triggers those SNMP notifications runs by default on Zimbra installs, whether or not anyone's actually monitoring the SNMP output.
How CVE-2026-73570 actually works
Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Zimbra security advisory, via The Hacker News
'As the Zimbra user' undersells the risk a little. That account typically has read access to every mailbox the server hosts, plus the ability to run Zimbra's own administrative tooling. An attacker doesn't need root to make this expensive — command execution as the service account that already owns your organization's email is most of the way there on its own.
Who's exploiting it, and what happens after they're in
SecurityWeek's reporting on the campaign is candid about the gap in what's known: the threat actor's identity and motive are still unclear. What is clear is the playbook once they're through the door — establishing persistence, harvesting credentials, reading email accounts, and moving laterally to other systems on the network. That's a standard access-broker pattern: get in quietly, grab what's valuable or sellable, and set up a way back in before anyone notices the front door was ever open.
An attacker running commands as the Zimbra service account typically has read access to every mailbox the server hosts. · Unsplash
What to actually check right now
Confirm your Zimbra Collaboration version — if it's below 10.1.20, treat this as urgent, not routine, patching.
Check whether the zimbra-snmp package is installed and whether snmp_notify is enabled; if you don't actively use SNMP monitoring, disable it entirely rather than just patching around it.
3
Pull /var/log/zimbra.log for the last 30 days and look for service-status changes you didn't trigger — a service flipping from stopped to running with no matching admin action is CERT Polska's flagged indicator.
4
Check /opt/zimbra/jetty/webapps/ and /opt/zimbra/jetty_base/webapps/ for files that shouldn't be there, and scan /tmp/ for anything recently dropped.
5
If you find anything, assume credentials were harvested and rotate them — don't just patch and move on.
8.9
CVSS score
High severity, unauthenticated, network vector
12,100+
Exposed servers
Internet-facing Zimbra instances tracked by Shadowserver
5 weeks
Patch-to-warning gap
Fix shipped July 20; active exploitation flagged August 17
Aug 24, 2026
CISA KEV deadline
Federal agencies given 3 days after the Aug 21 KEV addition
CERT Polska's indicators of compromise point admins at log timestamps and unexpected service restarts, not a single signature. · Unsplash
What version of Zimbra fixes CVE-2026-73570?
Version 10.1.20, released July 20, 2026. Any earlier version with the zimbra-snmp package installed and SNMP notifications enabled is vulnerable.
Is CVE-2026-73570 being actively exploited right now?
Yes. CERT Polska reported active exploitation in the wild on August 17, 2026, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 21, giving federal agencies until August 24 to patch.
Do I need to worry if I don't use SNMP monitoring?
You still need to check. The watchdog service that triggers the vulnerable code path runs by default on Zimbra installs even if nobody configured active SNMP monitoring — the safest move is to confirm the zimbra-snmp package isn't installed, or disable notifications outright.
What can an attacker do after exploiting this bug?
They get command execution as the Zimbra service account, which typically has access to every mailbox on the server. Reported post-compromise activity includes establishing persistence, harvesting credentials, reading email, and moving laterally to other systems.
Who's behind the exploitation campaign?
Unknown as of this writing. Security researchers tracking the activity haven't attributed it to a specific group or stated a clear motive.
Email servers keep landing back on this list for the same reason Adobe's ColdFusion and Campaign Classic bugs and SharePoint's JWT-forgery bug did earlier this year: they're old, self-hosted, internet-facing, and stuffed with the exact data — credentials, internal correspondence, password reset chains — that makes a breach expensive well past the initial intrusion. If your organization runs Zimbra and hasn't confirmed the version number since July, that's this week's actual to-do item, not a someday one.
