Critical Zimbra SNMP RCE Exploited via Crafted SMTP Requests

Attackers are actively exploiting CVE-2026-73570, a critical unauthenticated remote code execution flaw in Zimbra Collaboration Suite, according to CERT Polska. The vulnerability is an OS command injection issue in Zimbra's SNMP monitoring functionality that can be triggered with specially crafted SMTP requests when the optional zimbra-snmp package is installed, SNMP notifications are enabled, and the swatchdog service is running. Successful exploitation allows arbitrary command execution as the zimbra user, enabling web shell deployment, mailbox theft, persistence, and broader compromise.

Zimbra patched the flaw in version 10.1.20, and defenders are being urged to update immediately because exploitation has already been observed in the wild. CERT Polska recommended reviewing zimbra.log for suspicious activity, checking for unexpected Zimbra service restarts, and inspecting files created by the zimbra user in web application and temporary directories for malicious artifacts. Shadowserver reported that more than 12,100 internet-exposed Zimbra servers remain reachable, mainly in Europe and Asia, underscoring the scale of potential exposure.