CVE-2026-73570: Zimbra Collaboration Suite — Unauthenticated OS Command Injection via SNMP/SMTP

Background

CVE-2026-73570 is an unauthenticated OS command injection vulnerability (CWE-78) affecting Zimbra Collaboration Suite (ZCS) versions prior to 10.1.20. The flaw carries a CVSS 3.1 base score of 8.9 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) and allows a remote, unauthenticated attacker to execute arbitrary operating system commands as the zimbra user by sending specially crafted SMTP requests that abuse improper input sanitization in Zimbra’s SNMP notification processing path.

CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities (KEV) catalog on August 21, 2026, with a remediation deadline of August 24, 2026 — a three-day window that signals CISA has direct or corroborated evidence of active exploitation, even though the KEV entry itself lists “known ransomware campaign use” as Unknown. Independent of the KEV listing, Poland’s national CERT (CERT Polska) has publicly confirmed active exploitation of this vulnerability in the wild, and Shadowserver reports more than 12,100 internet-exposed Zimbra servers as of August 19, 2026, concentrated in Europe (4,382) and Asia (4,492). No ransomware group or named threat actor has been publicly attributed to exploitation of this specific CVE as of this writing; treat any such claims with skepticism until a vendor or CERT confirms them.

Given the unauthenticated, network-reachable attack path and confirmed in-the-wild exploitation, organizations running affected Zimbra deployments should patch immediately or apply the workaround below without waiting for a maintenance window.

Technical Mechanism

CVE-2026-73570 is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The root cause lies in how Zimbra’s SNMP notification subsystem constructs and hands off data when the swatchdog service detects a change in the status of a monitored service (e.g., a service transitioning from running to stopped, or vice versa). That status-change data feeds into the SNMP notification path without adequate sanitization.

The published attack vector is notable: rather than requiring direct access to the SNMP subsystem, an attacker can trigger the vulnerable code path by sending specially crafted SMTP requests to the Zimbra mail service. This lets an unauthenticated remote attacker reach code that ultimately constructs a system command using unsanitized input, resulting in arbitrary OS command execution with the privileges of the zimbra user.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) reflects:

• AV:N — network-exploitable, no local access required
• AC:H — high attack complexity, consistent with the need for the specific SNMP/swatchdog preconditions described above
• PR:N / UI:N — no privileges or user interaction required
• S:C — scope change, meaning the impact extends beyond the vulnerable component (arbitrary command execution as the zimbra OS user affects the underlying host, not just the mail application)
• C:H / I:H / A:L — high confidentiality and integrity impact, limited availability impact

Because command execution occurs as the zimbra user rather than root, the immediate blast radius is bounded by that account’s OS privileges — but on a mail server, the zimbra account already has read access to all local mailbox data, configuration, and TLS keying material, and write access to web application directories, which is more than sufficient for a serious compromise and a foothold for further privilege escalation.

Real-World Exploitation Evidence

Active exploitation has been independently confirmed by two credible sources:

1. CERT Polska publicly reported that threat actors are actively exploiting CVE-2026-73570 against internet-facing Zimbra servers.
2. CISA’s KEV addition on August 21, 2026, with a compressed 3-day remediation deadline (August 24, 2026) under Binding Operational Directive 22-01/26-04, which CISA reserves for vulnerabilities with confirmed or strongly suspected active exploitation.

Reporting citing CERT Polska describes post-exploitation activity consistent with opportunistic mass exploitation: attackers dropping web shells into Zimbra’s Jetty web application directories to establish persistent access after the initial command injection. No public reporting has attributed this campaign to a specific named threat actor, APT group, or ransomware operation as of this writing. Historical Zimbra vulnerabilities have separately been exploited by groups such as Winter Vivern, APT28, and APT29/Midnight Blizzard, but none of those attributions have been confirmed for CVE-2026-73570 specifically — treat any claims linking this CVE to a specific named group as unverified until a vendor or government advisory confirms it.

The KEV catalog’s “Known Ransomware Campaign Use” field for this entry is listed as Unknown, meaning CISA has not confirmed ransomware operators are using this flaw. That should not be read as a signal of low risk — the KEV addition and compressed deadline alone indicate CISA considers exploitation credible and ongoing.

Impact Assessment

Because command execution occurs as the zimbra user rather than root, the immediate blast radius is bounded by that account’s OS privileges — but on a mail server, the zimbra account already has read access to all local mailbox data, configuration, and TLS keying material, and write access to web application directories. That is more than sufficient for a serious compromise: an attacker who lands code execution can read every mailbox hosted on the server, harvest credentials and TLS private keys, and plant persistent web shells in Jetty’s web application directories to survive a simple service restart.

The confirmed post-exploitation pattern — web shells dropped into /opt/zimbra/jetty/webapps/ and /opt/zimbra/jetty_base/webapps/ — gives attackers durable, re-enterable access independent of the original SMTP-triggered injection, meaning a compromised host remains at risk even after the specific vulnerable code path is patched unless the host is also checked for planted shells. Given mail servers routinely sit at the center of an organization’s identity and communications infrastructure, compromise of a Zimbra instance can cascade into business email compromise, further phishing launched from a trusted internal domain, and exposure of sensitive correspondence — well beyond the scope of the host itself.

With more than 12,100 internet-exposed ZCS servers identified by Shadowserver and confirmed opportunistic mass exploitation underway, the practical impact is not limited to high-value targets; any internet-facing, unpatched Zimbra instance with SNMP notifications enabled is a viable target regardless of the organization’s size or profile.

Affected Versions

Precondition for exploitability: The vulnerability only affects deployments where the optional zimbra-snmp package is installed, SNMP trap notifications are enabled via the snmp_notify configuration parameter, and the swatchdog service is running. Because swatchdog (the service responsible for triggering SNMP notifications on service status changes) is enabled by default on installations with zimbra-snmp present, many organizations that installed the optional SNMP monitoring component may be exposed without realizing it.

Zimbra’s own advisory (via the vendor wiki and the 10.1.20 patch release notes) describes this as a fix for “a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled,” rated High severity by the vendor.

Remediation Steps

Primary remediation: Upgrade to Zimbra Collaboration Suite 10.1.20 or later. This is the only complete fix.

If immediate patching is not possible, mitigate exposure by removing the specific precondition that makes this flaw reachable:

• Disable SNMP trap notifications by unsetting or disabling the snmp_notify parameter in the Zimbra configuration.
• If the zimbra-snmp package is not required for your monitoring stack, uninstall it or stop and disable the swatchdog service entirely.
• Where full removal isn’t feasible, restrict network access to the SMTP service (port 25 and related MTA ports) to trusted mail relays and known-good sources only, reducing the pool of hosts that can deliver a crafted SMTP request to the vulnerable server. Note this is a compensating control, not a fix — SMTP servers generally need to accept mail from arbitrary internet hosts to function, so this workaround has real operational tradeoffs.

Given confirmed active exploitation and the CISA-mandated August 24, 2026 deadline for federal agencies, all organizations running affected Zimbra versions — federal or not — should prioritize the 10.1.20 upgrade over configuration-only mitigations.

Detection Guidance

Defenders should focus on the following, drawn from CERT Polska’s published guidance:

• Service status log anomalies: Review /var/log/zimbra.log for unexpected or suspicious service-status transition messages — particularly entries showing a service moving from “stopped” to “running” (or vice versa) that don’t correspond to legitimate administrative action or scheduled maintenance. This is the log signature associated with the swatchdog/SNMP notification path being triggered.

• Unexpected file creation in web application directories: Check the following paths for files created or modified by the zimbra user within the last 30 days that you cannot account for:

  • /opt/zimbra/jetty/webapps/
  • /opt/zimbra/jetty_base/webapps/
  • /tmp/

  Web shells dropped into the Jetty web application directories are the reported persistence mechanism following successful exploitation.

• Process and network monitoring: Look for unexpected child processes spawned by Zimbra service processes (particularly anything related to swatchdog or SNMP handling), and for outbound connections from the Zimbra host that don’t match normal mail server behavior.

• Configuration audit: Regardless of whether you find evidence of compromise, audit whether zimbra-snmp is installed and snmp_notify is enabled on every ZCS instance in your environment — this determines whether a given host was even exposed to this attack path.

• Exposure check: If your Zimbra instance is internet-facing, treat it as a priority target; Shadowserver’s scan data shows over 12,100 exposed ZCS servers globally as of August 19, 2026, making mass scanning by opportunistic attackers likely.

Any host confirmed to be running a pre-10.1.20 version with SNMP notifications enabled and internet-facing SMTP should be treated as a potential compromise pending log review, not just a patching task.

Timeline

References

• NVD — CVE-2026-73570 Detail
• Zimbra Security Advisories (vendor wiki)
• Zimbra Blog — Patch Release Update: Zimbra 10.1.20
• BleepingComputer — Critical Zimbra RCE flaw now actively exploited in attacks
• The Hacker News — Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
• Security Affairs — Poland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw