CVE-2026-73570

What is Zimbra Collaboration Suite?

Zimbra Collaboration Suite (ZCS) is a widely deployed open-source and commercial email, calendaring, and collaboration platform — a self-hosted alternative to Microsoft Exchange / Microsoft 365 used by governments, universities, ISPs, and enterprises worldwide. Because Zimbra servers are internet-facing mail systems holding an organization's email and identities, they are a long-standing, high-value target; the platform has repeatedly appeared in the KEV catalog. Command execution as the zimbra user gives an attacker control of the mail server and its contents.

Overview

CVE-2026-73570 is an OS command-injection vulnerability (CWE-78) in Zimbra's SNMP notification processing. An unauthenticated attacker can send specially crafted SMTP requests carrying attacker-controlled data that flows, unsanitized, into an OS command context during SNMP notification handling, resulting in execution of arbitrary shell commands as the zimbra service user. NVD scores it CVSS 8.9 HIGH with a Changed scope. Exploitation requires that the zimbra-snmp package be installed and SNMP notifications enabled.

Affected Versions

Technical Details

Untrusted input is improperly neutralized before reaching an operating-system command during SNMP notification processing. An attacker delivers the malicious data via crafted SMTP requests; when that data is used to build and run a shell command in the SNMP notification path, the injected commands execute as zimbra. The attack is unauthenticated (PR:N) and requires no user interaction, though the CVSS vector marks High attack complexity (AC:H), reflecting the specific conditions needed (SNMP package present and notifications enabled) and the crafted-request delivery. The Changed scope (S:C) reflects command execution crossing from the mail-processing component to the host account. The single crafted request makes this effectively a pre-authentication remote code execution primitive on affected configurations.

Discovery

The vulnerability is not attributed to a named researcher in public reporting. CERT Polska (CERT.PL) issued the alert documenting active exploitation, and the fix shipped in the Zimbra 10.1.20 security release.

Exploitation Context

Exploitation is confirmed in the wild. CERT Polska warned of active exploitation around 17 August 2026, and the Shadowserver Foundation reported roughly 267 compromised Zimbra instances by 24 August 2026 (peaking near 274), spread across the United States (46), Sweden (21), France (20), and Germany (17). No specific APT is firmly attributed to this CVE, though Zimbra has a history of being targeted by state-linked actors. Post-exploitation indicators include suspicious files in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/, with relevant activity in /var/log/zimbra.log.

Remediation

1. Upgrade to Zimbra Collaboration 10.1.20 or later immediately — this is the fixed release.
2. As an interim mitigation, if immediate patching is not possible, disable SNMP notifications and/or remove the zimbra-snmp package where it is not required, which removes the vulnerable code path.
3. Restrict SMTP exposure to what is necessary and place mail services behind appropriate network controls.
4. Hunt for compromise on exposed, unpatched servers: inspect /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ for web shells or unexpected files, and review /var/log/zimbra.log for anomalous SNMP/SMTP-driven command activity.
5. Rotate credentials and secrets accessible to the zimbra account, and treat mailbox data as potentially exposed if compromise is confirmed.