Zimbra email servers need urgent patching

Published August 24, 2026 CVE-2026-73570

Zimbra Collaboration Suite, an email server platform, has a bug attackers are actively exploiting right now. It lets an attacker take over a mail server and run their own commands without a password.

Severity
HighCVSS 3.1 · 8.9
Fix
Fixed in 10.1.20
Affected versions
before 10.1.20
Weakness
CWE-78OS Command Injection
Exploit likelihood
32% in 30 daysEPSS, higher than 98% of known flaws
Affects
Collaboration
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 21, 2026
Federal fix deadline
Aug 24, 2026

How it works

An attacker sends a specially crafted request to a Zimbra server that has SNMP monitoring notifications turned, and the server fails to clean that input before passing it to a system command, so the attacker's own commands run as the zimbra user.

What to do

Check your Zimbra Collaboration Suite version and whether SNMP notifications are enabled, and review zimbra service logs for unexpected restarts or new files created in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, or /tmp/ by the zimbra user over the last 30 days. Update to Zimbra Collaboration Suite 10.1.20 or later, which fixes CVE-2026-73570, and turn off SNMP notifications if you cannot patch right away.

Update CISA through its normal update channel, then confirm the installed version matches the newest vendor release.

Technical details

CVE-2026-73570 is a command injection flaw in the SNMP monitoring component of Zimbra Collaboration Suite. Improper sanitization of untrusted input during SNMP notification processing lets an unauthenticated attacker send specially crafted SMTP requests that trigger arbitrary operating system command execution as the zimbra user, when SNMP notifications are enabled. Zimbra fixed the issue in version 10.1.20, released July 20.

CERT Polska first flagged in-the-wild exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving U.S. federal civilian agencies until August 24 to patch. Shadowserver counts more than 12,000 Zimbra servers exposed to the internet. Zimbra servers have repeatedly been targeted by state-linked groups such as APT28 and APT29 in past incidents.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity High Attack depends on conditions outside the attacker's control
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact Low Reduced performance or interruptions
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L Open in FIRST.org calculator

References

View Original Source