Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw
CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.
CERT Polska confirmed threat actors are actively exploiting CVE-2026-73570, an unauthenticated OS command injection in Zimbra Collaboration Suite allowing arbitrary shell commands as the zimbra user. Exploitation requires the SNMP trap service via snmp_notify with swatchdog running, which is enabled by default; Shadowserver tracks over 12,100 internet-exposed Zimbra servers. Zimbra fixed the flaw in version 10.1.20 on July 20, 2026, 28 days before exploitation was confirmed. Historical Zimbra targeting includes Winter Vivern, APT29, and APT28 campaigns.
- CVE-2026-73570 is an unauthenticated OS command injection RCE
- Affects instances with SNMP notifications enabled and swatchdog service running
- Fixed in Zimbra 10.1.20 released July 20, 2026
- Over 12,100 Zimbra servers exposed online per Shadowserver
- CERT Polska published IOCs and log- and file-checking guidance
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-73570 | Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite CVE-2026-73570 is an OS command injection vulnerability (CWE-78) in Synacor Zimbra Collaboration Suite (ZCS) before 10.1.20, caused by improper sanitization of untrusted input during SNMP notification processing. It is triggered when the optional zimbra-snmp package is installed and SNMP notifications are enabled: an unauthenticated attacker sends specially crafted SMTP requests that the flawed notification path turns into execution of arbitrary operating system commands. Successful exploitation runs commands as the Zimbra user, giving attackers control of the mail server's service account with high confidentiality and integrity impact across the host. Only ZCS deployments running the optional SNMP component with notifications enabled are vulnerable; other Zimbra installs are not exposed to this specific flaw. The flaw is under active exploitation: CISA added it to the KEV catalog on 2026-08-21, Poland's CERT has warned of in-the-wild attacks, unpatched Zimbra servers are reported compromised, and two public proof-of-concept exploits exist. Do: Upgrade to Zimbra Collaboration Suite 10.1.20 or later per vendor instructions; as an interim mitigation, disable SNMP notifications or remove the zimbra-snmp package on hosts that do not need it. Federal operators must satisfy the CISA KEV/BOD 26-04 requirement, and all administrators of internet-facing Zimbra servers should hunt for signs of compromise (unexpected processes or persistence under the zimbra user) since unpatched systems are already being exploited. | 8.9 | 32% | KEV PoC ×4 |
| large≈10,000-50,000 internet-exposed ZCS servers, with only the subset running zimbra-snmp with notifications enabled actually vulnerable |
Full article642 words · extracted from securityaffairs.com · click to collapse
CERT Polska confirmed active exploitation of CVE-2026-73570, a critical unauthenticated RCE in Zimbra Collaboration Suite patched on July 20.
CERT Polska, Poland’s national computer emergency response team, confirmed this week that threat actors are actively exploiting a critical vulnerability in Zimbra Collaboration Suite tracked as CVE-2026-73570. The flaw allows unauthenticated remote code execution and was patched less than a month ago.
“The CERT Polska team informs about an actively exploited OS Command Injection vulnerability in Zimbra Collaboration Suite.” reads the advisory published by CERT Polska. “The vulnerability, identified as CVE-2026-73570 , allows an unauthenticated attacker to execute arbitrary shell commands with the privileges of the zimbra user . The vulnerability affects instances that have the SNMP trap service enabled via the snmp_notify parameter and the swatchdog service running (enabled by default).”
The vulnerability affects systems with SNMP trap notifications enabled and the swatchdog service running, which is enabled by default. The technical root cause is a sanitization failure in the SNMP monitoring component.
Zimbra released version 10.1.20 on 20 July 2026 to address the issue. The fix came 28 days before active exploitation was confirmed, which is not a wide window, but apparently wide enough.
The attack surface only exists when the optional zimbra-snmp package is installed and SNMP notifications are active, but swatchdog, the service that processes those notifications, is running by default on most installations.
Below are recommendations by CERT Polska:
“Due to the ongoing campaign exploiting this vulnerability, we recommend:
- verifying Zimbra logs /var/log/zimbra.log for the following entries:
Service status change: <szkodliwy ładunek> changed from stopped to running
Service status change: <szkodliwy ładunek> changed from running to stopped- verification of files created by user zimbra in the last 30 days in the following directories:
/opt/zimbra/jetty/webapps/
/opt/zimbra/jetty_base/webapps/
/tmp/If you discover any signs of potential exploitation of this vulnerability, please contact our team immediately.”
The exposure numbers aren’t reassuring. Shadowserver currently tracks over 12,100 Zimbra servers reachable from the Internet, split roughly between Europe (4,382) and Asia (4,492). That figure doesn’t distinguish between patched and unpatched instances, or between production servers and honeypots, so the real attack surface is smaller, but nobody knows by how much.
CERT Polska published indicators of compromise alongside the advisory and gave administrators specific places to look. The team recommends checking /var/log/zimbra.log for service status change entries where the payload transitions from stopped to running and back, which is the signature of a malicious command being executed as a service. Admins should also check whether any files were created in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, or /tmp/ by the zimbra user in the last 30 days. Web shells dropped into those directories would give persistent access after the initial command injection.
CVE-2026-73570 isn’t yet in CISA’s Known Exploited Vulnerabilities catalog, which currently lists 18 Zimbra Collaboration Suite entries, four of them added this year. The absence doesn’t mean the threat is lower; it means the catalog hasn’t caught up yet.
Zimbra solutions have been targeted by nation-state actors for years. Russian espionage group Winter Vivern exploited a reflected XSS flaw in February 2023 to steal emails from NATO-aligned organizations through Zimbra webmail portals. In October 2024, US and UK agencies warned that APT29, linked to Russia’s Foreign Intelligence Service, was targeting vulnerable Zimbra servers via a credential-stealing flaw. Most recently, in March 2026, Seqrite Labs researchers documented APT28, tied to Russian military intelligence, exploiting a stored XSS vulnerability against Ukrainian government Zimbra deployments.
Organizations in sectors targeted by Russian or Chinese state-backed groups should treat unpatched Zimbra servers as a high priority. CVE-2026-73570 is especially risky because attackers can exploit it without authentication, the vulnerable service is enabled by default, and many Zimbra servers are exposed online. These conditions make the flaw an attractive target for rapid exploitation.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Zimbra Collaboration Suite)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/197610/security/polands-cert-warns-of-active-exploitation-of-critical-zimbra-collaboration-suite-flaw.html