Summary
- CERT Polska has confirmed active exploitation of CVE-2026-73570 against Zimbra Collaboration.
- The flaw can permit unauthenticated command execution where the optional SNMP package and notifications are enabled.
- Zimbra addressed the issue in version 10.1.20, and CISA has added the vulnerability to its exploited catalogue.
A remotely exploitable vulnerability in Zimbra Collaboration has moved into active attacks, putting exposed enterprise mail servers at risk where optional monitoring functionality is enabled.
Zimbra fixed CVE-2026-73570 in version 10.1.20, but CERT Polska has since confirmed an exploitation campaign against vulnerable systems.
The vulnerability is an operating-system command injection issue in Zimbra Collaboration before 10.1.20. It affects installations where the optional zimbra-snmp package is installed, SNMP notifications are enabled and the associated swatchdog service is running.
An unauthenticated attacker can send specially crafted requests that cause arbitrary operating-system commands to run with the privileges of the Zimbra user. The flaw arises from insufficient sanitisation of untrusted input during SNMP notification processing.
CERT Polska warned on 17 August that it had observed active exploitation and provided indicators administrators could use to look for suspicious activity. The US Cybersecurity and Infrastructure Security Agency subsequently added CVE-2026-73570 to its Known Exploited Vulnerabilities catalogue on 21 August.
The technical preconditions narrow the vulnerable population compared with a flaw that applies to every default installation. They do not make the issue benign. Email servers are high-value systems because they combine internet exposure, user communications, stored information and links to identity and administrative infrastructure.
Compromise at the mail-server layer can also provide a foothold that is useful even when the attacker does not immediately target mailbox contents. Server access can support credential theft, persistence, internal reconnaissance or phishing from infrastructure already trusted by an organisation.
The vulnerability demonstrates a recurring problem around optional enterprise components. A feature may be disabled or absent in many installations and therefore receive less attention during routine vulnerability management, while organisations that enabled it years earlier may no longer have a clear inventory of the additional attack surface it created.
Monitoring functions are particularly sensitive because they often have access to service state, logs and operating-system processes. Here, the SNMP notification path becomes the route through which attacker-controlled input can reach command execution.
The presence of a patch before widespread public attention is another familiar feature of exploitation cycles. Version 10.1.20 was available before CERT Polska’s exploitation warning, leaving organisations with a period in which remediation existed but the operational urgency may not have been obvious.
Once exploitation is confirmed, the risk calculation changes. Patch prioritisation can no longer rely only on a severity score or theoretical exploitability; administrators have evidence that attackers are already using the flaw against real systems.
CERT Polska has advised organisations to check their Zimbra version and update to a release that removes the vulnerability. It also published log and filesystem checks intended to help identify possible exploitation.
No public attribution has been made for the campaign in the CERT Polska alert. The immediate issue is therefore narrower: Zimbra servers meeting the vulnerable configuration conditions should be treated as potentially exposed to an active unauthenticated command-execution route.
