CERT Polska has issued a warning regarding the active exploitation of a severe remote code execution (RCE) vulnerability within the Zimbra Collaboration Suite. This critical flaw, identified as CVE-2026-73570, enables unauthenticated attackers to execute arbitrary system commands on compromised servers, posing a significant security risk.
Understanding the Zimbra RCE Vulnerability
The vulnerability stems from an OS command injection issue found in Zimbra’s SNMP monitoring feature. This flaw affects systems deploying the optional zimbra-snmp package where SNMP notifications are activated via the snmp_notify parameter and the swatchdog service is operational. Given that swatchdog is typically enabled by default, many organizations could unknowingly be at risk.
Attackers can exploit this weakness by sending specially crafted SMTP requests that manipulate insufficient input sanitization during SNMP notification processing. Such exploitation allows them to execute arbitrary shell commands with Zimbra user privileges, potentially leading to severe consequences like web shell deployment or data theft.
Impact and Immediate Actions Required
Successful attacks enable threat actors to alter server configurations, maintain persistent access, or leverage the compromised server for further attacks. Zimbra has addressed CVE-2026-73570 in its 10.1.20 update, released on July 20, 2026. This version rectifies the command injection issue in the SNMP monitoring component.
Organizations operating on older versions must prioritize patching to mitigate the vulnerability, especially as active exploitation has been reported. CERT Polska provides guidance for detecting potential system breaches, advising administrators to scrutinize /var/log/zimbra.log for unusual or malicious payload transitions.
Monitoring and Mitigation Strategies
Security professionals should investigate any files generated by the Zimbra user in recent weeks, focusing on critical directories like /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/. Unanticipated JSP files or executable content could indicate malicious activity or sustained attacker presence.
To safeguard systems, organizations should promptly identify vulnerable Zimbra servers, verify SNMP notification settings, and apply security updates to version 10.1.20 or newer. In scenarios where immediate patching is unfeasible, disabling unnecessary SNMP functionalities and closely monitoring SMTP and Zimbra logs are recommended.
In case of suspected exploitation, it’s imperative to treat the situation as a potential system compromise. Administrators are urged to preserve logs, isolate affected machines, change credentials, review mailbox access logs, and conduct comprehensive incident response investigations.
Stay ahead of threats by integrating threat intelligence from over 15,000 SOCs into your security operations center to enhance your Tier 1 defenses.
