CERT Polska sees attacks on CVE-2026-73570
CERT Polska says attackers are now exploiting CVE-2026-73570 in Zimbra Collaboration Suite. Zimbra patched it in version 10.1.20 on July 20. Now it is being used in attacks.
The vulnerability is an unauthenticated command-injection bug in Zimbra's SNMP notification handling. Zimbra’s explanation, cited by BleepingComputer, says a specially crafted SMTP request can trigger arbitrary operating system command execution as the Zimbra user when SNMP notifications are enabled.
More than 12,100 Zimbra servers face the internet
Mail servers carry the company’s email, and ownership is often split between messaging, infrastructure and security teams. Now that attacks have started, not knowing where Zimbra runs or whether SNMP notifications are on is the bigger risk.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
BleepingComputer notes that Shadowserver is tracking more than 12,100 internet-exposed Zimbra servers, with a heavy concentration in Europe and Asia. Not all of them are necessarily vulnerable. It is still a lot of reachable servers.
Check versions, SNMP settings and 30 days of files
Patch, and also check for exposure and signs of compromise.
- Confirm every Zimbra deployment and whether each server is already on 10.1.20 or later.
- Check whether SNMP notifications are enabled. The attack path depends on them.
- Review logs for unexplained Zimbra service restarts and for suspicious files created by the
zimbrauser under/opt/zimbra/jetty/webapps/,/opt/zimbra/jetty_base/webapps/, and/tmp/during the last 30 days. - Prioritize any internet-facing Zimbra server ahead of ordinary backlog work and tighten access if patching cannot land immediately.
- If a server was compromised, plan for attacker persistence and access to mail data beyond that host.
Commands on the mail server reach executive and legal email
Zimbra carries executive and legal email along with everyday internal traffic. An attacker who can run commands on it can reach far more than the one host.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Sources
Primary source: BleepingComputer's reporting, including the file-system and restart indicators from CERT Polska.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
