CISA added a Zimbra Collaboration Suite (ZCS) vulnerability, tracked as CVE-2026-73570, to its Known Exploited Vulnerabilities catalog on August 21, 2026, confirming active exploitation in the wild. The flaw is an unauthenticated OS command injection bug affecting ZCS versions before 10.1.20, patched by Zimbra on July 20, 2026. CISA has given federal agencies until August 24, 2026 to remediate, and any organization self-hosting Zimbra for email should treat that same deadline as their own.
What CVE-2026-73570 Actually Does
According to the official NVD entry, the vulnerability lives in how ZCS handles SNMP notifications when the optional zimbra-snmp package is installed and notifications are turned on. An attacker who sends a specially crafted SMTP request can trigger arbitrary OS command execution as the Zimbra user, without ever authenticating. The CVSS score sits at 8.9, and the practical requirement for exploitation is narrower than a typical unauthenticated RCE: it needs zimbra-snmp installed with notifications enabled, plus the swatchdog service running, which happens to be on by default on many installs.
That “on by default” detail is what turns this from a niche edge case into a real exposure. A lot of admins never explicitly opted into SNMP monitoring in a way they’d remember to check, so the vulnerable configuration shows up more often than the feature name suggests it should.
Who’s Actually Behind the Exploitation
Poland’s CERT Polska reported observing active attacks against unpatched Zimbra instances this week and published indicators of compromise, though according to SecurityWeek’s reporting, the identity and motivation of the threat actor behind this specific campaign remain unclear. What is clear is the track record: previous Zimbra vulnerabilities of this class have been exploited by both state-sponsored groups going after military and diplomatic targets, and by opportunistic criminal groups just harvesting whatever mailboxes they can reach. Email servers are a rich target either way. A successful compromise here can mean credential harvesting, persistent mailbox access, and a foothold for lateral movement into the rest of the network, not just one leaked inbox.
What to Do About It
If you or a client runs a self-hosted Zimbra Collaboration Suite instance:
- Upgrade to 10.1.20 or later immediately. The patch has been available for over a month, so this isn’t a same-day emergency fix, it’s a “why hasn’t this shipped yet” gap.
- If you can’t patch right away, disable the zimbra-snmp package or turn off SNMP notifications as a stopgap, since that’s the specific condition the exploit depends on.
- Check for the indicators of compromise CERT Polska published if patching has lagged, particularly if swatchdog has been running unpatched since before July 20.
This is a good moment to audit anything else in your infrastructure sitting on a patch that shipped weeks ago and never got applied. We’ve seen the same pattern play out with unauthenticated RCE bugs in WordPress core and with actively exploited flaws that sat unpatched on endpoints: the window between “patch exists” and “attackers start scanning for it” keeps shrinking, and a month is plenty of time for that gap to get found.
