CVE-2026-73570 Exploited in the Wild: Unauthenticated RCE Hits Zimbra

TL;DR

CERT Polska reports active exploitation of a Zimbra unauthenticated remote code execution flaw, tracked as CVE-2026-73570. The bug scores 8.9 and hits Zimbra Collaboration before 10.1.20. Zimbra fixed it in version 10.1.20. Patch without delay.

Why It Matters

Zimbra runs email for governments, universities, and firms worldwide. Attackers target it often, so any RCE draws fast abuse. This Zimbra unauthenticated remote code execution flaw is already exploited in the wild, per CERT Polska.

An attacker needs no credentials to strike. Success grants command execution as the zimbra user. From there, an intruder can plant web shells and read mail.

How the Attack Works

The flaw lives in the SNMP notification handling of Zimbra Collaboration. Zimbra does not sanitize untrusted input during that processing. As a result, crafted input reaches the shell.

An unauthenticated attacker sends specially crafted requests to a vulnerable instance. The server then runs arbitrary OS commands as the zimbra user. This unauthenticated remote code execution path requires the optional zimbra-snmp package and enabled SNMP notifications. The swatchdog service, on by default, plays a role too.

Signs of Compromise

CERT Polska shares hunting tips in its active exploitation alert. Check /var/log/zimbra.log for odd service status change entries. Review files created by the zimbra user in the last 30 days under the Jetty webapps and /tmp directories.

Affected Versions

The flaw affects Zimbra Collaboration releases before 10.1.20. Instances with the zimbra-snmp package and SNMP notifications enabled are at risk. Zimbra does not publish an install-count estimate for exposed systems.

Patch and Mitigation Steps

Upgrade Zimbra Collaboration to version 10.1.20 right away. Review the Zimbra Security Advisories for release notes. If you cannot patch now, hunt for the indicators above and isolate suspect hosts.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.