CERT Polska’s Alert 145/2026 has escalated: an unauthenticated remote code execution flaw in Zimbra Collaboration Suite (ZCS) that Zimbra quietly patched five weeks ago is now being actively exploited against mail servers that haven’t updated. CVE-2026-73570 (CVSS 8.9) lets an attacker with no credentials run arbitrary operating-system commands as the zimbra user by abusing the product’s SNMP-based notification pipeline.

What happened

The bug lives in how Zimbra processes SNMP trap notifications. On deployments that have the optional zimbra-snmp package installed and SNMP notifications enabled via the snmp_notify parameter, service-health events are watched by swatchdog — a monitoring process that is enabled by default wherever SNMP notifications are turned on. When swatchdog detects a service transitioning between running and stopped states, it builds and dispatches a notification message using data pulled from that event.

The flaw is straightforward input-sanitization failure: values that feed into the notification-generation path aren’t properly escaped before being handed to a shell. An unauthenticated attacker who can reach the affected notification interface can craft input that breaks out of the intended data context and injects arbitrary OS commands, executed with the privileges of the zimbra service account. Because the trigger point sits in a monitoring/notification path rather than behind a login form, no valid session, API token, or user interaction is required.

Zimbra fixed the issue in 10.1.20, released July 20, 2026. CERT Polska’s advisory, followed by a similar warning from Belgium’s CCB, confirms that threat actors are now actively exploiting unpatched instances — meaning the roughly one-month gap between patch availability and public disclosure of exploitation gave attackers a substantial head start against organizations that treat mail-server updates as low priority.

Affected versions

  • Zimbra Collaboration Suite versions prior to 10.1.20
  • Exploitable only where the optional zimbra-snmp package is installed and snmp_notify is enabled, with swatchdog running — but SNMP notifications are a common monitoring configuration on production mail infrastructure, not an edge case

Impact

Command execution as the zimbra user hands an attacker a serious foothold on a system that, by design, holds the entire organization’s mail store: message contents, attachments, contact lists, calendar data, and authentication material for connected services. Responders tracking active campaigns report post-exploitation activity consistent with web shell deployment, persistence mechanisms, tampering with application files, and direct access to mailbox data — the standard playbook once command execution is achieved on a groupware server. A compromised Zimbra instance is also a durable phishing and business-email-compromise launchpad, since outbound mail from a legitimate corporate domain bypasses most reputation-based filtering.

Mitigation

  • Patch to 10.1.20 or later immediately. This is a pre-auth RCE with confirmed in-the-wild exploitation; treat it as an emergency change, not a scheduled maintenance item.
  • If patching can’t happen right away, disable SNMP notifications (snmp_notify) and, where feasible, remove the zimbra-snmp package entirely to eliminate the vulnerable code path.
  • Hunt for prior compromise, not just future exposure — a month-old patch with newly disclosed active exploitation means some environments were likely hit before anyone was watching for it. Review /var/log/zimbra.log for anomalous service-status transitions (unexpected stopped→running or running→stopped events) that don’t correspond to legitimate administrative action or scheduled maintenance, and check for unfamiliar files under the web-accessible directories and unexpected processes running as zimbra.
  • Restrict network reachability to Zimbra’s SNMP and administrative interfaces to trusted management networks only; these services should not be exposed broadly even when patched.

Sources

  • CERT Polska Alert 145/2026
  • CCB Belgium advisory on actively exploited Zimbra RCE
  • Zimbra Collaboration 10.1.20 release notes