Zimbra Vulnerability Exploited to Enable Unauthenticated Remote Command Execution

CERT Polska Reports Ongoing Attacks Against ZCS

CERT Polska has reported active exploitation of CVE-2026-73570, a command injection vulnerability in Zimbra Collaboration Suite (ZCS). The flaw may allow a remote attacker to execute commands on the system without authentication.

The issue affects ZCS installations before version 10.1.20, but only when both of the following conditions apply:

• the optional zimbra-snmp package is installed;
• SNMP notifications are enabled.

Zimbra fixed the vulnerability in version 10.1.20. Installations upgraded to this release or later are not within the affected version range.

The CVE record was published by NVD on August 13, 2026, and modified on August 14, 2026. MITRE CNA assigned a CVSS 3.1 score of 8.9, HIGH, with the following vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

NVD has not yet published its own CVSS assessment; the NIST/NVD score is therefore listed as N/A.

How the Vulnerability Works

The attack begins with specially crafted SMTP requests. While processing SNMP notifications, Zimbra fails to properly neutralize certain input elements. An attacker may therefore attempt to inject commands intended for the operating system.

The vulnerability is classified as CWE-78, referring to the improper neutralization of special elements used in an operating system command. If exploitation succeeds, the code runs remotely with the privileges of the zimbra user.

Authentication is not required, and no user interaction is needed. The CVSS vector indicates network access, no pre-existing privileges, and potentially high impacts on confidentiality and integrity. The impact on availability is rated low.

The score therefore indicates a serious flaw, but the requirement for both zimbra-snmp and SNMP notifications limits the number of systems directly exposed. Administrators should verify both settings rather than assume that every ZCS installation before 10.1.20 is automatically exploitable.

Active Exploitation, but Not Yet Listed in the CISA KEV Catalog

CERT Polska describes exploitation activity that has been observed or is ongoing. However, an SSVC assessment from CISA-ADP in the NVD record lists exploitation: none, along with automatable: no and technicalImpact: total.

These two data points do not align. CERT Polska’s operational report indicates that exploits have been detected, while the SSVC field preserved in the CVE record indicates no exploitation. The CERT report should therefore be treated as a concrete risk indicator, without presenting the NVD field as definitive refutation.

Available information does not indicate that CVE-2026-73570 has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Accordingly, there is no catalog entry date or CISA remediation deadline to report for this flaw.

The NVD record links to the Zimbra Security Center and Zimbra Security Advisories pages, but does not disclose attacker-used filenames, hashes, IP addresses, or specific payloads.

What to Check on Zimbra Servers

The priority is to upgrade ZCS to version 10.1.20 or later. Before and during the upgrade, administrators should verify whether the zimbra-snmp package is installed and whether SNMP notifications are enabled.

CERT Polska also recommends reviewing:

/var/log/zimbra.log

Administrators should look particularly for suspicious restarts of Zimbra services. A single restart does not necessarily indicate compromise, but it becomes a significant warning sign when it coincides with unusual SMTP activity or the appearance of new files.

Newly created files from the last 30 days should also be checked in:

/opt/zimbra/jetty/webapps/
/opt/zimbra/jetty_base/webapps/
/tmp/

New files in these locations, combined with unexpected service restarts, may indicate the installation of persistence mechanisms or other post-exploitation activity. Available information does not provide specific filenames to look for or more detailed indicators.

If signs consistent with an intrusion are found, the system should not be considered simply “patched and resolved.” Organizations should preserve logs, analyze added files, and review affected accounts, processes, and configurations.

The Earlier CVE-2025-66376 and the Laundry Bear Campaign

The risk comes amid an already challenging security landscape for Zimbra. CVE-2025-66376 affects the Classic UI through a stored cross-site scripting technique.

The flaw allows CSS @import directives to be inserted into HTML email messages. According to the NVD description, it affects ZCS 10 versions before 10.0.18 and ZCS 10.1 versions before 10.1.13. However, the product’s structured record lists the range as below 10.0.18, creating a discrepancy that administrators should consider when verifying versions.

CVE-2025-66376 has a CVSS 3.1 score of 7.2, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

The vulnerability has been listed in the CISA KEV catalog since March 18, 2026. For U.S. federal agencies, the remediation deadline was April 1, 2026. CISA’s recommended action is to apply the vendor’s mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

A phishing campaign attributed by the U.S. government to the Russia-aligned actor Laundry Bear, also known as CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard, reportedly targeted Zimbra servers belonging to Western government and commercial organizations from at least July 2025. In that campaign, CVE-2025-66376 was reportedly used to deliver ZimReaper, a JavaScript payload designed to collect email communications and other sensitive data.

There is no public attribution linking the exploitation of CVE-2026-73570 to Laundry Bear. The earlier campaign nevertheless shows that Zimbra environments have already been targeted and that patching, telemetry, and file monitoring should not be delayed.