What Changed
CERT Polska says attackers are now exploiting CVE-2026-73570 in Zimbra Collaboration Suite. Zimbra patched the flaw in version 10.1.20 on July 20, but the issue has now moved from patch guidance into active-attack territory.
The vulnerability is an unauthenticated command-injection bug in Zimbra's SNMP notification handling. According to the vendor explanation cited in the source reporting, a specially crafted SMTP request can trigger arbitrary operating system command execution as the Zimbra user when SNMP notifications are enabled.
Why This Is An Operations Problem Fast
Mail infrastructure is uncomfortable to patch late because it sits directly on business communication paths and often carries complicated ownership between messaging, infrastructure, and security teams. Once exploitation begins, uncertainty around deployment footprint and feature configuration becomes more dangerous than the headline itself.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
BleepingComputer notes that Shadowserver is tracking more than 12,100 internet-exposed Zimbra servers, with a heavy concentration in Europe and Asia. That does not prove all are vulnerable, but it does show how much reachable attack surface still exists.
What To Verify First
Treat this as mail-server exposure verification plus compromise checking, not a normal patch ticket.
- Confirm every Zimbra deployment and whether each server is already on 10.1.20 or later.
- Check whether SNMP notifications are enabled, because that feature state matters directly to exploitability.
- Review logs for unexplained Zimbra service restarts and for suspicious files created by the
zimbrauser under/opt/zimbra/jetty/webapps/,/opt/zimbra/jetty_base/webapps/, and/tmp/during the last 30 days. - Prioritize any internet-facing Zimbra server ahead of ordinary backlog work and tighten access if patching cannot land immediately.
- Assume a compromised mail server can become both a persistence and data-access problem, not just a host-remediation problem.
What Teams May Be Underestimating
The mistake here is thinking of Zimbra as just another application server. It is a trust platform for executive communication, legal communication, and ordinary internal coordination. Once attackers can run commands there, the blast radius is larger than the host itself.
That is why this story deserves a stand-alone article. Readers need a clean view of the exact flaw, the exposure conditions, and the concrete indicators worth checking right now.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Source Context
CyberExperts used BleepingComputer's reporting as the primary source for this article and preserved the useful details: CVE-2026-73570, the SNMP notification attack path, the fixed Zimbra version, the visible internet-facing footprint, and the specific file-system and restart indicators highlighted by CERT Polska.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Friday’s brief: forgotten servers on a seven-country advisory, then Splunk, Bricksforge and exposed dashboards
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
