Zimbra: Critical Zimbra RCE Vulnerability Actively Exploited in the Wild

Critical Zimbra RCE Vulnerability Exploited in the Wild (CVE-2026-73570)

CERT Polska has issued a warning about active exploitation of a critical remote code execution (RCE) vulnerability in Zimbra Collaboration Suite, tracked as CVE-2026-73570. The flaw allows unauthenticated attackers to execute arbitrary OS commands as the zimbra user on affected servers.

The vulnerability stems from an OS command injection in Zimbra’s SNMP monitoring functionality, specifically when:

• The optional zimbra-snmp package is installed,
• SNMP notifications are enabled via the snmp_notify parameter, and
• The swatchdog service (enabled by default) is running.

Attackers exploit the flaw by sending maliciously crafted SMTP requests, bypassing input sanitization during SNMP notification processing. Successful exploitation grants unauthenticated command execution, enabling threat actors to:

• Deploy web shells,
• Steal mailbox data,
• Modify server configurations,
• Establish persistence, or
• Use compromised servers as a launch point for further attacks.

Zimbra released a patch in version 10.1.20 (July 20, 2026), addressing the command injection issue in the SNMP component. Organizations running earlier versions are urged to upgrade immediately, as exploitation has already been observed in the wild.

Detection & Mitigation Guidance
CERT Polska recommends administrators:

• Inspect /var/log/zimbra.log for suspicious service-status messages indicating unauthorized process changes.
• Review files created by the zimbra user in the last 30 days, particularly in:
  • /opt/zimbra/jetty/webapps/
  • /opt/zimbra/jetty_base/webapps/
  • /tmp/
    (Unexpected JSP files, scripts, or modified content may signal compromise.)
• Disable SNMP notifications if patching is delayed and monitor SMTP activity, logs, and process/file changes tied to the zimbra account.

Suspected exploitation should be treated as a full compromise, requiring log preservation, host isolation, credential rotation, and incident response.

Source: https://cybersecuritynews.com/zimbra-rce-vulnerability-exploited/

Synacor cybersecurity rating report: https://www.rankiteo.com/company/synacor

"id": "SYN1787208788",
"linkid": "synacor",
"type": "Vulnerability",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Technology/Email Collaboration',
                        'name': 'Zimbra Collaboration Suite users',
                        'type': 'Software/Service Provider'}],
 'attack_vector': 'SMTP requests',
 'data_breach': {'data_exfiltration': 'Possible',
                 'type_of_data_compromised': 'Mailbox data'},
 'date_publicly_disclosed': '2026-07-20',
 'description': 'CERT Polska has issued a warning about active exploitation of '
                'a critical remote code execution (RCE) vulnerability in '
                'Zimbra Collaboration Suite, tracked as CVE-2026-73570. The '
                'flaw allows unauthenticated attackers to execute arbitrary OS '
                'commands as the *zimbra* user on affected servers. Attackers '
                'exploit the flaw by sending maliciously crafted SMTP '
                'requests, bypassing input sanitization during SNMP '
                'notification processing. Successful exploitation grants '
                'unauthenticated command execution, enabling threat actors to '
                'deploy web shells, steal mailbox data, modify server '
                'configurations, establish persistence, or use compromised '
                'servers as a launch point for further attacks.',
 'impact': {'data_compromised': 'Mailbox data',
            'operational_impact': 'Unauthorized command execution, persistence '
                                  'establishment, further attacks',
            'systems_affected': 'Zimbra Collaboration Suite servers'},
 'post_incident_analysis': {'corrective_actions': 'Patch Zimbra to version '
                                                  '10.1.20 or later, disable '
                                                  'SNMP notifications if '
                                                  'patching is delayed',
                            'root_causes': 'OS command injection in SNMP '
                                           'monitoring functionality due to '
                                           'improper input sanitization'},
 'recommendations': ['Upgrade to Zimbra version 10.1.20 or later immediately',
                     'Disable SNMP notifications if patching is delayed',
                     'Monitor for suspicious activity in logs and file changes',
                     'Treat suspected exploitation as a full compromise'],
 'references': [{'source': 'CERT Polska'}],
 'response': {'containment_measures': ['Inspect /var/log/zimbra.log for '
                                       'suspicious service-status messages',
                                       'Review files created by the *zimbra* '
                                       'user in the last 30 days',
                                       'Disable SNMP notifications if patching '
                                       'is delayed',
                                       'Monitor SMTP activity, logs, and '
                                       'process/file changes'],
              'enhanced_monitoring': 'Monitor SMTP activity, logs, and '
                                     'process/file changes tied to the '
                                     '*zimbra* account',
              'remediation_measures': ['Upgrade to Zimbra version 10.1.20 or '
                                       'later',
                                       'Isolate compromised hosts',
                                       'Rotate credentials']},
 'title': 'Critical Zimbra RCE Vulnerability Exploited in the Wild '
          '(CVE-2026-73570)',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-73570 (OS command injection in SNMP '
                            'monitoring functionality)'}