Zimbra CVE-2026-73570 Exploited in the Wild: Who Needs to Patch Immediately

Ongoing Attacks Against Zimbra Servers

A vulnerability in Zimbra Collaboration, tracked as CVE-2026-73570, has been observed being exploited in the wild against exposed servers. CERT Polska reported detecting attacks “this week”; the news was published on August 20, 2026.

The attacker’s identity and the campaign’s objectives are unknown. However, CERT Polska has published indicators of compromise that administrators should retrieve from the original advisory and compare against their own systems.

The flaw affects Zimbra Collaboration, also known as the Zimbra Collaboration Suite (ZCS). An unauthenticated remote attacker can exploit it to execute arbitrary commands on the operating system with the privileges of the Zimbra user.

The condition is specific: the optional zimbra-snmp package must be installed and SNMP notifications must be enabled on the server. Affected versions are those prior to 10.1.20.

How the Vulnerability Works

CVE-2026-73570 is an OS command injection vulnerability classified as CWE-78. The issue results from improper sanitization of untrusted data while processing SNMP notifications.

The attack vector uses specially crafted SMTP requests. No credentials or user interaction are required. Although the attack complexity is considered high, the potential impact is significant: execution takes place under the Zimbra user account and may affect systems beyond the directly vulnerable component.

The CVSS 3.1 score is 8.9, rated high, with the following vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

The score was assigned by CNA MITRE. NVD has not yet published its own assessment; for CVSS 4.0, 3.x, and 2.0, the NIST score is currently listed as N/A.

The combination of remote access, no authentication requirements, and high confidentiality and integrity impact makes the flaw particularly serious for deployments that use Zimbra as their primary email platform.

Potential Impact of a Compromised Server

Command execution with Zimbra user privileges does not automatically provide complete operating system control, but it gives an attacker a significant operational foothold.

After the initial compromise, the attacker could attempt to:

• establish persistence on the server;
• access mailboxes and messages;
• harvest credentials and tokens;
• modify email configurations or rules;
• use the system to reach other internal resources;
• exfiltrate data or information stored in the infrastructure.

The risk is greatest for organizations managing corporate, institutional, or administrative email on Zimbra servers directly reachable from the network. A compromised mail server can also become a trusted platform for internal phishing campaigns, abuse of legitimate accounts, and email theft.

No attribution has been disclosed for the current campaign. Previous operations targeting Zimbra vulnerabilities have involved both state-sponsored groups seeking military and diplomatic information and opportunistic criminals motivated by profit. This history does not allow CVE-2026-73570 to be attributed to any specific actor.

The Fix and Required Checks

The fix is included in Zimbra Collaboration 10.1.20, released on July 20. Administrators should upgrade to version 10.1.20 or later, following the vendor’s supported procedures.

The first check should confirm whether the optional package is installed:

zimbra-snmp

The status of SNMP notifications should also be reviewed. Installations that do not use this feature should consider disabling or removing it through Zimbra’s documented procedures. This reduces the attack surface but does not replace the upgrade.

After patching, organizations should review:

• SMTP logs for unusual or specially crafted requests;
• unexpected processes running under the zimbra user;
• recent changes to scripts, configurations, and scheduled tasks;
• unusual mailbox access;
• newly created accounts, forwarding rules, or persistence mechanisms;
• connections to previously unseen internal systems.

The indicators published by CERT Polska can support threat hunting, but they must be obtained from the official advisory, as they are not reproduced here.

If compromise is suspected, isolate the server without destroying evidence. Preserve logs and artifacts, rotate potentially exposed credentials, review email accounts, and investigate possible lateral movement within the network.

CVE-2026-73570 Is Not Yet in the CISA KEV Catalog

As of the date represented by the CISA source, CVE-2026-73570 is not listed in the Known Exploited Vulnerabilities (KEV) Catalog. Therefore, there is no CISA listing date or specific CISA remediation deadline for this flaw.

Its absence from the catalog does not reduce the urgency: CERT Polska has already reported exploitation in real-world attacks. KEV is a prioritization tool, not a comprehensive list of every observed attack.

Zimbra nevertheless has 18 vulnerabilities listed in the CISA KEV Catalog. Recent examples include CVE-2025-48700, added on April 20, 2026, with a due date of April 23, 2026, and CVE-2025-66376, added on March 18, 2026, with a due date of April 1, 2026.

CISA also added CVE-2020-7796 on February 17, 2026, with a due date of March 10, 2026, and CVE-2025-68645 on January 22, 2026, with a due date of February 12, 2026. For these vulnerabilities, the recommended actions are to apply the vendor’s mitigations, follow applicable requirements for cloud services, or discontinue use of the product if no mitigations are available.

This history shows that CVE-2026-73570 is not an isolated incident for the Zimbra ecosystem. Administrators should immediately verify exposure, the presence of zimbra-snmp, SNMP notification settings, and the installed version—without waiting for possible inclusion in KEV.