Zimbra: Critical Zimbra OS Command Injection Vulnerability Exploited in the Wild

Critical Zimbra Collaboration Suite Vulnerability Under Active Exploitation

A severe command-injection flaw in Zimbra Collaboration Suite (CVE-2026-73570) is being actively exploited, prompting urgent patching and system reviews. Identified as an OS command injection vulnerability in Zimbra’s SNMP monitoring path, the flaw allows unauthenticated remote attackers to execute arbitrary commands as the zimbra user.

The vulnerability affects deployments where SNMP trap notifications are enabled via the snmp_notify parameter and the swatchdog service is running both of which are active by default in some configurations. Exploitation occurs through specially crafted SMTP requests, enabling attackers to bypass authentication and gain access to mail-related data, application directories, and service processes.

Successful exploitation could lead to mailbox theft, web shell deployment, credential harvesting, or lateral movement within the Zimbra environment. Zimbra addressed the issue in version 10.1.20, and administrators are advised to upgrade immediately. Systems should be checked for signs of compromise, including unexpected service state changes in /var/log/zimbra.log and suspicious files in directories such as /opt/zimbra/jetty/webapps/ and /tmp/.

While disabling SNMP notifications may reduce exposure, it does not replace the need for the official patch. Organizations are urged to isolate affected hosts, preserve logs, and rotate credentials to mitigate potential damage.

Source: https://cyberpress.org/critical-zimbra-os-command-injection-vulnerability/

Zimbra cybersecurity rating report: https://www.rankiteo.com/company/zimbra

"id": "ZIM1787214230",
"linkid": "zimbra",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Technology/Email Collaboration',
                        'name': 'Zimbra Collaboration Suite users',
                        'type': 'Software/Service Provider'}],
 'attack_vector': 'SMTP requests',
 'data_breach': {'sensitivity_of_data': 'High (mailbox data, credentials)',
                 'type_of_data_compromised': 'Mail-related data, application '
                                             'directories, service processes'},
 'description': 'A severe command-injection flaw in Zimbra Collaboration Suite '
                '(CVE-2026-73570) is being actively exploited, allowing '
                'unauthenticated remote attackers to execute arbitrary '
                'commands as the *zimbra* user. The vulnerability affects '
                'deployments where SNMP trap notifications are enabled via the '
                '*snmp_notify* parameter and the *swatchdog* service is '
                'running. Exploitation occurs through specially crafted SMTP '
                'requests, enabling attackers to bypass authentication and '
                'gain access to mail-related data, application directories, '
                'and service processes. Successful exploitation could lead to '
                'mailbox theft, web shell deployment, credential harvesting, '
                'or lateral movement within the Zimbra environment.',
 'impact': {'data_compromised': 'Mail-related data, application directories, '
                                'service processes',
            'operational_impact': 'Potential mailbox theft, web shell '
                                  'deployment, credential harvesting, lateral '
                                  'movement',
            'systems_affected': 'Zimbra Collaboration Suite (versions prior to '
                                '10.1.20)'},
 'post_incident_analysis': {'corrective_actions': 'Patch management, log '
                                                  'monitoring, credential '
                                                  'rotation',
                            'root_causes': 'OS command injection vulnerability '
                                           'in SNMP monitoring path '
                                           '(CVE-2026-73570)'},
 'recommendations': 'Upgrade to Zimbra version 10.1.20 immediately, review '
                    'logs for signs of compromise, rotate credentials, and '
                    'consider disabling SNMP notifications as a temporary '
                    'mitigation.',
 'references': [{'source': 'Zimbra Security Advisory'}],
 'response': {'containment_measures': 'Isolate affected hosts, preserve logs, '
                                      'rotate credentials',
              'enhanced_monitoring': 'Check for unexpected service state '
                                     'changes in */var/log/zimbra.log* and '
                                     'suspicious files in '
                                     '*/opt/zimbra/jetty/webapps/* and */tmp/*',
              'remediation_measures': 'Upgrade to Zimbra version 10.1.20, '
                                      'disable SNMP notifications (temporary '
                                      'mitigation)'},
 'title': 'Critical Zimbra Collaboration Suite Vulnerability Under Active '
          'Exploitation',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2026-73570 (OS command injection in SNMP '
                            'monitoring path)'}