FHN 
CERT Polska has warned that threat actors are actively exploiting CVE-2026-73570, a critical command-injection vulnerability affecting Zimbra Collaboration Suite.
The flaw allows remote, unauthenticated attackers to execute operating system commands with the privileges of the zimbra user. This creates a serious risk for organizations running internet-facing Zimbra mail servers.
How the Zimbra Flaw Can Be Exploited
The vulnerability is associated with Zimbra’s SNMP trap functionality. Exploitation is possible when the snmp_notify parameter is enabled and the swatchdog service is running.
Since swatchdog is enabled by default, systems using the affected SNMP configuration may be exposed without requiring an attacker to have valid credentials.
Successful exploitation could give attackers access to the underlying mail server, allowing them to run commands, create or modify files, steal email data, deploy web shells, establish persistence, or attempt to move deeper into the organization’s network.
Active Exploitation and Detection
CERT Polska has confirmed that the vulnerability is being used in an ongoing attack campaign, making this more than a theoretical security concern.
Zimbra has addressed the issue in version 10.1.20. Administrators should verify their installed version and upgrade affected systems as soon as possible.
Organizations that cannot patch immediately should review whether SNMP trap functionality is required and check if the snmp_notify configuration is enabled.
Security teams should also inspect /var/log/zimbra.log for unusual “Service status change” entries. Unexpected service names, commands, or changes between running and stopped states could indicate malicious activity.
It is also important to search for recently created or modified files owned by the zimbra user, particularly in:
/opt/zimbra/jetty/webapps//opt/zimbra/jetty_base/webapps//tmp/
Look for unfamiliar JSP files, scripts, archives, executable files, or heavily obfuscated content. Unexpected outbound connections from the Zimbra server should also be investigated.
What Organizations Should Do
Organizations running vulnerable Zimbra installations should prioritize upgrading to version 10.1.20 or a later fixed release.
If compromise is suspected, isolate the affected server, preserve relevant logs and suspicious files for forensic investigation, rotate potentially exposed credentials, and check other connected systems for signs of lateral movement.
The active exploitation of CVE-2026-73570 highlights why internet-facing email infrastructure requires rapid patching and continuous monitoring. Patching should be followed by log analysis and threat hunting to ensure attackers have not already established persistence.
About the Author
