Zimbra SNMP RCE Under Active Exploitation, CVSS 8.9, Over 12,000…

CVE-2026-73570 enables unauthenticated RCE via Zimbra's optional SNMP component. CERT Polska confirms active exploitation; patch available since July.

On August 20, 2026, CERT Polska confirmed active in-the-wild exploitation of CVE-2026-73570, a command injection vulnerability in the optional SNMP component of Zimbra Collaboration Suite. The flaw is unauthenticated, carries a CVSS score of 8.9, and the attack surface exceeds 12,100 internet-exposed servers. The affected component — zimbra-snmp — is often overlooked in hardening configurations because it is considered ancillary. The patch has been available since version 10.1.20, released on July 20, 2026.

Key Takeaways

Command injection in SNMP notification processing: unsanitized input from SMTP requests is passed to shell commands executed as the zimbra user, with CWE-78 documented by NVD.
Specific technical conditions: requires the zimbra-snmp package installed, snmp_notify enabled, and the swatchdog service running — the latter active by default in standard installations.
Active exploitation confirmed by government source: CERT Polska issued a bulletin with an explicit advisory for an "actively used OS Command Injection vulnerability" and a request to contact them for signs of compromise.
Measured attack surface: Shadowserver tracks over 12,100 exposed Zimbra servers, with 4,382 in Europe and 4,492 in Asia — without a known count of systems already compromised.

How the Attack Works: From Optional Package to Shell

The mechanism is documented in the official CVE-2026-73570 record on NVD with the CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L. The zimbra-snmp component handles SNMP trap notifications through the swatchdog service, a watchdog enabled by default that monitors Zimbra service status. During SNMP notification processing, input derived from SMTP requests is not adequately sanitized.

A remote, unauthenticated attacker sends specially crafted SMTP requests. The payload traverses SNMP processing and executes as the zimbra user, with the same privileges as the mail service. Attack complexity is rated "High" in CVSS — the vector requires specific conditions — but the simultaneous presence of zimbra-snmp, snmp_notify enabled, and swatchdog running makes the exploit feasible on installations that have not explicitly disabled SNMP monitoring.

The vector's scope (Scope: Changed in the CVSS score) indicates the vulnerable component impacts resources beyond its original security context, typically the underlying operating system.

"A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed, and SNMP notifications are enabled"
— NIST National Vulnerability Database (NVD), CVE-2026-73570

Who Confirmed the Attack and What We Know

CERT Polska, Poland's national incident response team, issued an original advisory in Polish with specific IoCs and a direct request for organizations detecting signs of compromise to make contact. The shared indicator — reported in translation — shows log patterns with "service status change" transitioning from stopped to running with suspicious payloads. The bulletin describes the attack as targeting a "nieuwierzytelnionemu atakującemu," meaning an unauthenticated attacker.

Source convergence is solid: The Hacker News published full technical details with timeline and mechanism; BleepingComputer confirmed active exploitation citing CERT Polska explicitly; SecurityWeek added historical context from previous Zimbra campaigns. None of the primary sources report discrepancies on the patched version, release date, or attack vector.

CISA has not yet added CVE-2026-73570 to its Known Exploited Vulnerabilities (KEV) catalog, as documented by both SecurityWeek and direct verification of the CISA catalog consulted as a contextual source. This does not invalidate CERT Polska's exploitation confirmation, but indicates the U.S. federal inclusion process is not yet complete at the time of the sources.

Map of Exposed Servers: Europe and Asia on the Front Lines

According to Shadowserver data reported by BleepingComputer, over 12,100 Zimbra servers are reachable on the internet with the exposure profile relevant to this vulnerability. Geographic distribution shows 4,382 systems in Europe and 4,492 in Asia, with the remainder distributed across the Americas and other regions. The figure does not indicate how many of these servers actually have zimbra-snmp installed and snmp_notify active — so the effective attack surface is an unquantified subset of the 12,100 total.

No data emerges on the number of servers already compromised, nor on the start date of the exploitation campaign. The threat actor's identity remains unattributed: no infrastructure overlap with previous campaigns has been documented by sources at the time of analysis.

What to Do Now

Update to Zimbra 10.1.20. The patch was released on July 20, 2026 and resolves the vulnerability in SNMP notification processing. The update is the definitive mitigation documented by sources.

Verify the presence of zimbra-snmp and swatchdog status. If the SNMP package is installed but not required for operations, disabling it removes the vector. The swatchdog service, active by default, should be checked among running processes.

Check IoCs published by CERT Polska. The suggested observation window is 30 days: analyze /var/log/zimbra.log for suspicious service status changes and search for files created by the zimbra user in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/.

Consider contacting CERT Polska. The original advisory explicitly requests organizations detecting signs of compromise to contact the Polish national response team for incident response support.

Why the SNMP Vector Is Insidious

Zimbra's choice to include SNMP monitoring as an optional package reflects a recurring pattern in email infrastructure: auxiliary components installed for functional completeness, then forgotten in hardening cycles. SNMP is a network management protocol designed to read metrics and receive traps, not to process arbitrary input from the network. Its placement at the perimeter — often in subnets where SMTP traffic is permitted for operational necessity — exposes it to unintended interaction with malicious payloads.

The unauthenticated nature of the exploit eliminates any credential-based filtering barrier. No valid accounts are needed, no initial phishing, no preliminary access. Mere network reachability of the Zimbra service with the technical conditions satisfied is sufficient. This explains why CERT Polska activated a national-level advisory: the potential impact on government and corporate mail infrastructure is immediate and difficult to mitigate with traditional perimeter controls.

Zimbra servers typically host mailboxes with sensitive communications, credentials for corporate services, attached documents, and relational metadata. An RCE compromise as the zimbra user opens full access to the mail filesystem, potential persistence via startup mechanisms, and use of the server as a pivot for lateral movement within the internal network. The lack of required authentication drastically lowers the attack cost for the threat actor.

Frequently Asked Questions

Are all Zimbra installations vulnerable?

No. The vulnerability triggers only if the optional zimbra-snmp package is installed, snmp_notify is enabled, and the swatchdog service is running. Installations without this combination are not exposed to the documented vector.

Why is the CVSS score 8.9 and not 10 if the attack is unauthenticated?

The CVSS:3.1 vector shows Attack Complexity: High (AC:H), reflecting the specific technical conditions required. Impact on availability is also rated Low (A:L). Severity remains "High" but not maximum Critical.

What if the server cannot be updated immediately?

Sources do not document official temporary mitigations beyond removal or disabling of the zimbra-snmp package. CERT Polska's advisory focuses on patching and post-compromise forensic analysis. The brief does not specify official vendor workarounds for non-upgradable versions.

Information verified against cited sources and current as of publication.

Sources

Sources and references