Zimbra email servers hacked in remote code attacks
Attackers have broken into more than 270 Zimbra email servers by exploiting a flaw that lets them run their own commands without ever logging in. Zimbra maker Synacor already released a fix, but thousands of servers are still exposed.
- Report priority
- Medium
- Involves
- Zimbra Collaboration Suite
What is known
Zimbra servers that have the optional SNMP monitoring add-on installed and turned for notifications will pass incoming monitoring data straight into a system command instead of treating it as plain data, so an attacker can smuggle their own commands inside that data and have the server run them.
What to do
Check whether your Zimbra server has the zimbra-snmp package installed with SNMP notifications enabled and whether it is running a version older than 10.1.20, and look for the Zimbra service restarting unexpectedly or new files created by the zimbra user in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, or /tmp/ over the past 30 days.
Update to outdated Zimbra Collaboration Suite versions Patch 12 or later through the Zimbra admin console or contact your IT team for help.
Reported details
Zimbra servers with the optional zimbra-snmp monitoring add-on installed and SNMP notifications turned on accept network monitoring messages without requiring a login. An attacker sends the server monitoring data rigged to include extra commands. Zimbra passes that data into a system command, so the attacker's commands run on the server instead. Shadowserver scans found 274 Zimbra servers already compromised this way, and CERT Polska told administrators to check logs for the Zimbra service restarting on its own and new files planted by the zimbra system user.
CVE-2026-73570 is an OS command injection flaw in the SNMP monitoring component of Zimbra Collaboration Suite (ZCS), reachable only on instances that have the optional zimbra-snmp package installed with SNMP notifications enabled. An unauthenticated attacker can send crafted SNMP notification input that gets executed as an operating system command, giving remote code execution. Synacor fixed it in ZCS 10.1.20, released July 20. CERT Polska first flagged in-the-wild exploitation, CISA added the flaw to its KEV catalog and gave US federal agencies until August 24 to patch, and Shadowserver counted 274 compromised instances in scans on August 22 alongside roughly 8,200 still-unpatched but not-necessarily-exploitable instances.