Zimbra RCE Vulnerability Under Active Exploitation
A now-patched security vulnerability in Zimbra Collaboration (ZCS) is being actively exploited in the wild, according to the Polish Computer Emergency Response Team (CERT Polska). The flaw, tracked as CVE-2026-73570 with a CVSS score of 8.9 (High), is a command injection vulnerability in Zimbra's SNMP handling code that allows unauthenticated attackers to execute arbitrary commands on the server.
Vulnerability Details
CVE-2026-73570 is a command injection flaw that exists in how Zimbra Collaboration processes SNMP-related operations. The vulnerability can be triggered without authentication, making it particularly severe for internet-exposed Zimbra deployments.
Key facts:
- CVE: CVE-2026-73570
- CVSS Score: 8.9 (High)
- Attack Vector: Network
- Authentication Required: None
- Impact: Full remote code execution on the Zimbra server
- Status: Patched by Zimbra; actively exploited in the wild
The command injection allows attackers to inject shell metacharacters into SNMP-processed input, causing the server to execute attacker-controlled commands with Zimbra service-level privileges.
Active Exploitation Confirmed
CERT Polska's disclosure confirms that threat actors are actively scanning for and exploiting unpatched Zimbra servers. Zimbra Collaboration is a high-value target due to its role as a corporate email and collaboration platform — compromising a Zimbra instance gives attackers access to:
- Corporate email and calendar data
- User credentials and authentication tokens
- Internal communications and attachments
- A trusted internal mail relay for phishing campaigns
Given the unauthenticated nature of the exploit, mass exploitation is likely by automated scanners following the public disclosure.
Affected Versions
Zimbra Collaboration versions prior to the security patch addressing CVE-2026-73570 are affected. Organizations should consult the official Zimbra security advisories for the exact version cutoff and upgrade path.
Immediate Remediation Steps
- Patch immediately — Apply the Zimbra security update that addresses CVE-2026-73570. This is the highest priority action.
- Check exposure — Determine whether your Zimbra SNMP port (UDP 161/162) is accessible from the internet. It should not be.
- Review server logs for signs of exploitation — look for unexpected command execution, process spawning, or outbound connections from Zimbra processes.
- Audit for persistence — If exploitation is suspected, check for new cron jobs, SSH keys, web shells in Zimbra's webroot, or new system user accounts.
- Network segmentation — Ensure Zimbra management interfaces (SNMP, admin console) are not internet-accessible. Firewall SNMP ports at the perimeter.
Broader Zimbra Security Context
Zimbra has been a recurring target for nation-state actors and cybercriminals. Previous vulnerabilities (including CVE-2022-27925, CVE-2023-37580, and CVE-2024-45519) have been exploited by APT groups targeting government, telecommunications, and financial sector organizations.
Security teams running Zimbra should:
- Subscribe to Zimbra security advisories for prompt notification
- Maintain a rapid patching SLA of 24-72 hours for critical/high-severity Zimbra flaws given their historical exploitation rate
- Deploy network-level monitoring to detect SNMP abuse and unusual Zimbra process behavior
- Consider email security gateway solutions that operate independently of the Zimbra server to maintain continuity during incident response