A significant security vulnerability in Zimbra Collaboration Suite (ZCS) has been actively exploited, as reported by the Polish Computer Emergency Response Team (CERT Polska). This issue, now resolved, was associated with the Zimbra SNMP package, which allowed remote code execution when exploited.
Details of the Vulnerability
Identified as CVE-2026-73570 with a CVSS score of 8.9, the flaw involved command injection, posing a severe risk to systems. The vulnerability was present in ZCS versions preceding 10.1.20, specifically when the SNMP notifications were active. It was caused by improper input sanitization, enabling attackers to execute arbitrary commands on the host operating system through crafted SMTP requests.
The issue has been addressed with the release of ZCS version 10.1.20, which users are strongly encouraged to update to in order to secure their systems from potential attacks.
Active Exploitation Alerts
Recently, CERT Polska issued warnings about ongoing exploitation attempts targeting this flaw. They advised users to scrutinize the “/var/log/zimbra.log” file for unusual Zimbra service activities and to examine specific directories for any suspicious files created in the past month, including “/opt/zimbra/jetty/webapps/“, “/opt/zimbra/jetty_base/webapps/“, and “/tmp/“.
Such vulnerabilities in Zimbra have been a common focus for cyber attackers. This particular flaw presents significant risks if left unpatched, as attackers can gain unauthorized access to sensitive systems and data.
Previous Attacks and Ongoing Threats
Vulnerabilities in Zimbra systems have historically been exploited by various threat actors. Last month, the U.S. government highlighted a phishing operation linked to the Russian group known as Laundry Bear. This campaign targeted Zimbra servers across Western entities since mid-2025, utilizing a different flaw, CVE-2025-66376, to inject malicious JavaScript, named ZimReaper, to steal sensitive information.
The persistence of such targeted attacks underscores the necessity for consistent patch management and proactive monitoring to safeguard against potential threats.
As the cybersecurity landscape continues to evolve, staying informed and vigilant is crucial in preventing exploitations that could have detrimental impacts on organizational security and data integrity.
