Zimbra SNMP Command Injection Exploited to Deploy Web Shells and Steal Mailboxes

Attackers are exploiting CVE-2026-73570, a command-injection vulnerability in Zimbra Collaboration Suite’s SNMP notification subsystem that enables unauthenticated remote command execution. The flaw carries a CVSS score of 8.9. Synacor reportedly patched it in version 10.1.20 on July 20, 2026, but delayed disclosure until August 13, giving attackers an opportunity to reverse-engineer the changes. Exploitation includes outbound callbacks to verify execution, deployment of JSP web shells, and abuse of Zimbra utilities to retrieve credentials and export entire mailboxes. Shadowserver reportedly identified approximately 274 compromised production instances, while roughly 10,000 public-facing deployments remained exposed to scanning.

Organizations should upgrade to 10.1.20 or newer, disable SNMP if immediate patching is impractical, investigate unauthorized JSP files, rotate potentially compromised credentials, and restrict administrative access. Patching alone does not remove existing attacker access, making compromise assessment essential. Separately, CERT Polska has reported credential theft through a UNC1151 campaign exploiting Roundcube and a new wave of NGate NFC-relay malware targeting Polish bank customers; these are distinct campaigns, with no reported link to the Zimbra exploitation.