Attackers are actively taking advantage of a recently patched Zimbra SNMP flaw, according to CERT Polska. The issue, tracked as CVE-2026-73570 with a CVSS score of 8.9, can allow an unauthenticated adversary to trigger command injection that may result in remote code execution.
This matters because exploitation is already happening in the wild. If you run Zimbra Collaboration (ZCS) and have the relevant SNMP component enabled, you should treat this as an urgent patching and monitoring event.
What the Zimbra SNMP flaw does
The vulnerability is tied to Zimbra Collaboration servers before version 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
At a technical level, the problem is improper sanitization of untrusted input during SNMP notification processing. NIST’s vulnerability description explains that an unauthenticated attacker can send specially crafted SMTP requests. Those requests may lead to the execution of arbitrary operating system commands as the Zimbra user.
Because the attacker does not need authentication, the risk is not limited to environments where credentials are already compromised. The exposure depends on configuration (SNMP notifications + the optional package) and on whether the system has been patched.
Who reported the exploitation and what to do now
CERT Polska says the flaw has been under active exploitation. In a bulletin earlier this week, the organization urged administrators to verify whether their systems show signs of abnormal activity.
Start by checking /var/log/zimbra.log for suspicious service restarts. Unexpected restarts can be a symptom of exploitation attempts, crashing processes, or changes caused by injected commands.
Next, review file creation activity within the last 30 days under the following directories:
- /opt/zimbra/jetty/webapps/
- /opt/zimbra/jetty_base/webapps/
- /tmp/
If you find new or unexpected files in these locations, treat them as indicators for deeper investigation. At minimum, you should compare timestamps against legitimate deployment or maintenance windows and validate file contents and ownership.
Patch availability: update to 10.1.20
Zimbra addressed the vulnerability last month by releasing an update that fixes CVE-2026-73570. The bulletin points to version 10.1.20 as the patched baseline.
If your servers are running any ZCS version earlier than 10.1.20, prioritize upgrading as soon as possible. After the upgrade, you can reduce risk by also reviewing whether SNMP notifications are truly needed and ensuring the configuration is aligned with your security policy.
Why Zimbra attacks keep appearing
Vulnerabilities in Zimbra have repeatedly attracted threat activity. The source notes that, last month, details emerged about a phishing campaign linked to a Russia-affiliated adversary known as Laundry Bear (also referred to as CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard).
That disclosure described targeting of Zimbra mail servers belonging to Western government and commercial organizations starting at least July 2025. The campaign weaponized CVE-2025-66376, a stored cross-site scripting issue in Zimbra’s Classic UI.
The attackers used it to deliver a malicious JavaScript payload dubbed ZimReaper, aiming to harvest email communications and other sensitive data.
The connection between these events is not that the two vulnerabilities are the same, but that threat actors continue to view Zimbra ecosystems as high-value targets. When one weakness gets patched, others may still be exploited—so ongoing security hygiene matters.
Practical response checklist
If you want to respond quickly to the current Zimbra SNMP flaw reporting, use a simple sequence of actions.
1) Confirm affected configuration
Validate whether your Zimbra deployment includes the zimbra-snmp package and whether SNMP notifications are enabled. Even if you didn’t intend to use SNMP notifications, accidental or legacy configurations happen.
2) Patch immediately
Upgrade to 10.1.20 or later. If downtime windows are required, you still want a prioritized plan—because the flaw is already being exploited.
3) Inspect logs and recent file activity
Review /var/log/zimbra.log for suspicious restart patterns. Then check for new or altered files within the last 30 days in:
- /opt/zimbra/jetty/webapps/
- /opt/zimbra/jetty_base/webapps/
- /tmp/
4) Investigate anomalies
If you discover unexpected artifacts, investigate how they arrived and what processes were responsible. Focus on command execution pathways tied to the SNMP notification processing context and verify whether any unexpected web application content was introduced under the Jetty webapps directories.
5) Reassess exposure
After patching, consider whether SNMP notifications are necessary in your environment. Reducing optional components and tightening configuration can help lower the chance of future exploitation paths.
What “unauthenticated remote code execution” means for administrators
The most alarming aspect of CVE-2026-73570 is that it can be triggered without authentication, given the right conditions. In practice, this means a vulnerable configuration can potentially be targeted by an attacker who reaches the system and can send crafted requests.
The impact described by NVD is command injection that may allow arbitrary operating system commands to run as the Zimbra user. That combination increases both the probability of compromise and the potential severity, since it can turn a network-exposed service into a foothold for additional actions.
Bottom line
The Zimbra SNMP flaw tracked as CVE-2026-73570 is not theoretical—CERT Polska reports active exploitation. If you operate Zimbra Collaboration and run versions earlier than 10.1.20 with the zimbra-snmp package and SNMP notifications enabled, update urgently and monitor for suspicious restarts in /var/log/zimbra.log and for recent file activity under /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/.
Patch now, verify your exposure, and treat any anomalies as potential compromise until proven otherwise.
Source: https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html
