What Changed
CERT Polska says attackers are now exploiting CVE-2026-73570 in Zimbra Collaboration Suite. Zimbra patched the flaw in version 10.1.20 on July 20, but the issue has now moved from patch guidance into active-attack territory.
The vulnerability is an unauthenticated command-injection bug in Zimbra's SNMP notification handling. According to the vendor explanation cited in the source reporting, a specially crafted SMTP request can trigger arbitrary operating system command execution as the Zimbra user when SNMP notifications are enabled.
Why This Is An Operations Problem Fast
Mail infrastructure is uncomfortable to patch late because it sits directly on business communication paths and often carries complicated ownership between messaging, infrastructure, and security teams. Once exploitation begins, uncertainty around deployment footprint and feature configuration becomes more dangerous than the headline itself.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Free. Weekday mornings. Unsubscribe anytime.
Built from 100+ trusted cybersecurity sources.
BleepingComputer notes that Shadowserver is tracking more than 12,100 internet-exposed Zimbra servers, with a heavy concentration in Europe and Asia. That does not prove all are vulnerable, but it does show how much reachable attack surface still exists.
What To Verify First
Treat this as mail-server exposure verification plus compromise checking, not a normal patch ticket.
- Confirm every Zimbra deployment and whether each server is already on 10.1.20 or later.
- Check whether SNMP notifications are enabled, because that feature state matters directly to exploitability.
- Review logs for unexplained Zimbra service restarts and for suspicious files created by the
zimbrauser under/opt/zimbra/jetty/webapps/,/opt/zimbra/jetty_base/webapps/, and/tmp/during the last 30 days. - Prioritize any internet-facing Zimbra server ahead of ordinary backlog work and tighten access if patching cannot land immediately.
- Assume a compromised mail server can become both a persistence and data-access problem, not just a host-remediation problem.
What Teams May Be Underestimating
The mistake here is thinking of Zimbra as just another application server. It is a trust platform for executive communication, legal communication, and ordinary internal coordination. Once attackers can run commands there, the blast radius is larger than the host itself.
That is why this story deserves a stand-alone article. Readers need a clean view of the exact flaw, the exposure conditions, and the concrete indicators worth checking right now.
Source Context
CyberExperts used BleepingComputer's reporting as the primary source for this article and preserved the useful details: CVE-2026-73570, the SNMP notification attack path, the fixed Zimbra version, the visible internet-facing footprint, and the specific file-system and restart indicators highlighted by CERT Polska.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
