Zimbra SNMP Flaw Exploited for Remote Code Execution

CVE-2026-73570 (CVSS score: 8.9) is now being actively exploited in the wild, according to a security advisory from Poland’s Computer Emergency Response Team, CERT Polska.

What the vulnerability is and how it can be triggered

The NIST National Vulnerability Database describes CVE-2026-73570 as a case of command injection that can lead to remote code execution. "A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed, and SNMP notifications are enabled," the NVD entry states. It adds that "Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user."

In short: installations of Zimbra Collaboration Server that have the optional zimbra-snmp package present and SNMP notifications turned on are susceptible to unauthenticated SMTP traffic that contains specially crafted content. The vulnerability can allow execution of operating system commands with the privileges of the Zimbra user.

Patch status: Zimbra 10.1.20

Zimbra issued a fix last month in version 10.1.20. Organizations running vulnerable ZCS builds prior to 10.1.20 who have the zimbra-snmp component and SNMP notifications enabled are the population named by the vulnerability description.

The CERT Polska bulletin that flagged active exploitation pointed defenders to the available patch and supplied specific forensic checks for signs of compromise (see next section).

CERT Polska indicators and suggested checks

CERT Polska alerted to ongoing attacks and urged administrators to look for signs that may indicate successful exploitation. The guidance specified two types of indicators to inspect:

• Suspicious service behavior: examine "/var/log/zimbra.log" for evidence of Zimbra service restarts tied to unexpected activity.
• New files placed by an attacker: check for files created within the last 30 days in these directories:
  • /opt/zimbra/jetty/webapps/
  • /opt/zimbra/jetty_base/webapps/
  • /tmp/

Those filesystem locations and the Zimbra log are the specific artifacts CERT Polska recommended defenders review to identify possible exploitation stemming from the SNMP notification processing flaw.

Context: recent Zimbra-targeting and the U.S. government disclosure

Zimbra servers have been repeatedly targeted in recent months. The source notes that last month the U.S. government disclosed a phishing campaign run by a Russia-linked actor known as Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that targeted Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.

That earlier campaign weaponized CVE-2025-66376, a stored cross-site scripting vulnerability in Zimbra's Classic UI, to deliver a JavaScript payload called ZimReaper intended to harvest email communications and other sensitive data. The CERT Polska alert about active exploitation of CVE-2026-73570 arrives against this recent pattern of focused interest in Zimbra deployments.

What this means for technologists, Western government and commercial organizations, and the U.S. government

Technologists and security teams: review whether your Zimbra installation includes the optional zimbra-snmp package and whether SNMP notifications are enabled; apply Zimbra 10.1.20 if you run an affected release; inspect "/var/log/zimbra.log" and the three webapps and /tmp directories for files created in the last 30 days as CERT Polska advised.

Western government and commercial organizations previously named as targets: the recent U.S. government disclosure of Laundry Bear activity and CERT Polska’s bulletin together signal heightened attention to Zimbra as an operational target; organizations in those sectors should treat the overlapping advisories as a prompt to verify patch status and investigate the specified indicators of compromise.

The U.S. government: having publicly disclosed the earlier Laundry Bear phishing campaign, the U.S. government’s prior advisory establishes a continuity of concern about Zimbra-targeting; the new CERT Polska warning documents a move from disclosure of phishing and stored XSS exploitation to active in-the-wild exploitation of a separate remote code execution flaw.

Attackers exploiting unauthenticated command injection in SNMP notification processing and the prior use of stored XSS to deploy ZimReaper together illustrate a recurring theme in this reporting: when a widely deployed mail platform like Zimbra has an exploitable component, multiple adversaries will probe and weaponize distinct weaknesses. Whether the active exploitation documented by CERT Polska leads to widespread compromise will depend on how rapidly administrators apply Zimbra 10.1.20 and follow the bulletin’s forensic checks for signs of intrusion.

Original report: https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html