The active exploitation of CVE-2026-73570 in Zimbra Collaboration Suite deserves immediate attention because this is not merely another webmail vulnerability requiring a user to open a malicious email or click a link. It is an unauthenticated operating-system command injection flaw that can be triggered through specially crafted SMTP requests when the optional `zimbra-snmp` package is installed and SNMP notifications are enabled. Successful exploitation can allow an external attacker to execute arbitrary operating-system commands as the Zimbra user without possessing valid credentials and without requiring any user interaction. Zimbra fixed the issue permanently in ZCS 10.1.20, released on July 20, 2026, and CERT Polska has now confirmed that attackers are actively exploiting the vulnerability in real environments.

CVE-2026-73570 is classified as CWE-78, improper neutralization of special elements used in an OS command, or OS command injection. The vulnerability exists in Zimbra's SNMP notification processing. In vulnerable configurations, attacker-controlled information received through SMTP can ultimately reach operating-system command processing without being sufficiently sanitised. An attacker can therefore construct an SMTP request containing input that changes the meaning of the command executed by the underlying system. Instead of the application processing the supplied information purely as data, part of that information can be interpreted as an operating-system command. The CVE has a CVSS 3.1 score of 8.9, with network accessibility, no privileges required and no user interaction, while the technical impact is considered potentially total.

The prerequisite that `zimbra-snmp` must be installed and SNMP notifications enabled is important, but it should not create a false sense of comfort. Zimbra is commonly deployed as an Internet-facing email server, meaning its SMTP service is deliberately reachable from untrusted networks. If the vulnerable SNMP configuration is present, the attacker does not first need to compromise a mailbox or administrative account. SMTP itself becomes the delivery mechanism for the malicious input. This is particularly dangerous because blocking ordinary web access to the Zimbra administration console does not necessarily protect against an attack arriving through the mail-processing path.

The vulnerability is also strategically valuable because an email server is an extremely attractive system to compromise. Zimbra servers contain years of email correspondence, attachments, contact information, calendars and potentially credentials or password-reset messages. They may also communicate with LDAP or Active Directory infrastructure and have trusted access to DNS, backup systems, mail gateways and internal networks. Code execution on the mail server can therefore provide an attacker with both valuable information and an excellent foothold for further compromise.

The fact that commands execute as the Zimbra user rather than immediately as root does reduce one layer of impact, but it should not be interpreted as minor compromise. The Zimbra account necessarily has extensive access to the mail platform and its files. An attacker gaining code execution can potentially read configuration information, inspect mail-related data, modify application files, deploy additional malicious code, establish persistence and search the system for credentials or configuration secrets that enable further privilege escalation or lateral movement. Attackers do not particularly object to receiving slightly less than root access on their first attempt.

CERT Polska's warning provides some useful indicators for defenders. Administrators are advised to investigate unexpected Zimbra service restarts and look for files created by the `zimbra` user during the previous 30 days in `/opt/zimbra/jetty/webapps/`, `/opt/zimbra/jetty_base/webapps/`, and `/tmp/`. These locations are significant because attackers who gain command execution may attempt to deploy web shells or other persistent files that allow them to return even after the original vulnerability has been patched.

This creates an important distinction between vulnerability remediation and incident remediation. Upgrading to Zimbra 10.1.20 prevents future exploitation of CVE-2026-73570, but it does not remove a web shell that an attacker may already have installed before the upgrade. Any organisation that had a vulnerable Internet-facing server while active exploitation was occurring should therefore perform compromise assessment in addition to patching. Installing the update and immediately declaring the incident closed would be wonderfully convenient, but attackers rarely respect the administrative neatness of patch-management processes.

The first preventive action should therefore be immediate upgrade to Zimbra Collaboration Suite 10.1.20 or a later supported release. Zimbra explicitly states that 10.1.20 contains the permanent fix for this command-injection vulnerability and strongly recommends upgrading. Administrators should verify the actual running version rather than merely confirming that an update has been downloaded or scheduled.

Customers should also determine whether the vulnerable functionality is actually required. If SNMP monitoring or SNMP notifications are not operationally necessary, disabling unnecessary components reduces the exposed attack surface. This principle extends beyond Zimbra: services, plugins and monitoring components that are installed but unused still contain code and therefore vulnerabilities. An optional feature that nobody remembers enabling can become a surprisingly permanent security liability.

Internet exposure should also be minimised according to function. SMTP understandably needs to be reachable from the Internet for a public mail server, but administrative interfaces, management ports and internal Zimbra services should not be publicly accessible. Administrative access should be restricted through VPN, zero-trust access controls or dedicated management networks, with MFA enabled for administrator accounts. Network segmentation should ensure that compromise of the mail server does not automatically provide unrestricted connectivity to domain controllers, backup repositories, databases and other critical internal systems.

Because the exploit arrives through SMTP, mail traffic inspection and IPS controls can provide an additional defensive layer where reliable signatures or behavioural detection are available. However, customers should not treat an IPS signature as a substitute for patching. Application-layer command-injection attacks can frequently be modified to bypass simple static signatures, particularly when different encodings or command representations are possible. The patched application remains the primary control; network inspection is defence in depth.

Customers should closely monitor process behaviour on Zimbra servers. A mail-processing component spawning shells, command interpreters, download utilities or unexpected binaries should immediately attract attention. Security teams should investigate processes such as `bash`, `sh`, `curl`, `wget`, scripting runtimes or other utilities being launched unexpectedly by Zimbra-related services. Endpoint detection and response, where supported on the underlying server, can be particularly useful because it allows defenders to observe what happens after the malicious SMTP request has been processed.

Outbound traffic from the Zimbra server should also be tightly controlled and monitored. A mail server legitimately communicates with many SMTP destinations, DNS servers and internal infrastructure, but it generally should not initiate arbitrary web connections to unfamiliar Internet hosts. Restricting outbound connectivity makes it more difficult for an attacker to download second-stage payloads, establish command-and-control or exfiltrate information after successful command injection. Unexpected HTTP or HTTPS traffic initiated by a Zimbra service should therefore be investigated.

File-integrity monitoring can provide another useful detection layer. Administrators should baseline critical Zimbra directories and alert when new JSP files, scripts or executables appear in application directories. CERT Polska's recommendation to inspect Jetty web application directories is particularly important because placing a malicious JSP file there could provide an attacker with a web-accessible persistence mechanism independent of the original SMTP exploit.

Security teams should also examine authentication and mailbox activity following suspected compromise. Even though CVE-2026-73570 itself does not require credentials, attackers who gain access to the host may subsequently steal credentials, create mail forwarding rules or access individual mailboxes. Unexpected administrative sessions, new accounts, modified forwarding rules, unexplained password resets and unusual mailbox access should therefore be reviewed as part of incident response.

Credential rotation may be necessary if there is evidence of exploitation. Zimbra service credentials, administrator passwords, LDAP credentials, database credentials, API keys and any other secrets accessible from the compromised host should be assumed potentially exposed until investigation establishes otherwise. Simply changing the user's mailbox password is unlikely to be sufficient if the attacker gained operating-system-level execution.

Backups also require careful treatment. Organisations should maintain recent, tested backups of Zimbra data and configuration, but backup repositories should be isolated from the production mail server and protected using separate credentials. An attacker who compromises an email server should not automatically inherit the ability to modify or delete its backups. Recovery procedures should also be tested because a backup that has never been restored is less a recovery strategy than an optimistic collection of files.

The large number of Internet-facing Zimbra systems increases the urgency. Shadowserver was tracking more than 12,100 exposed Zimbra servers when the active exploitation warning was published, with thousands located in Europe and Asia. It is not currently clear how many of those systems remain vulnerable, but once reliable exploitation begins, Internet-wide scanning makes identifying susceptible servers comparatively inexpensive for attackers.

Zimbra also has a history of attracting advanced threat actors. Previous vulnerabilities have been exploited by groups including Winter Vivern, APT29 and APT28 to target governments and other high-value organisations. That history matters because mail systems contain exactly the information intelligence-oriented attackers want: internal discussions, strategic documents, contacts and correspondence. CVE-2026-73570 therefore should not be viewed only through the lens of opportunistic cybercrime. Internet-facing Zimbra installations may also be attractive targets for espionage operations.

For customers, the practical defence should therefore combine several layers: upgrade immediately to 10.1.20 or later, disable unnecessary SNMP functionality, restrict management access, segment the Zimbra server from critical infrastructure, inspect historical logs, search for files created by the Zimbra user in the directories identified by CERT Polska, monitor suspicious child processes, restrict outbound communication and rotate credentials where compromise is suspected. Vulnerable servers that were exposed during the exploitation period should be investigated even if no obvious outage or suspicious mailbox activity has occurred.

The broader lesson from CVE-2026-73570 is that email security cannot stop at spam filtering and malicious attachments. The mail server itself is an Internet-facing application processing untrusted attacker-controlled data continuously. A specially crafted SMTP message can therefore become an exploit rather than merely a message. Organisations need vulnerability management, IPS protection, application hardening, segmentation and behavioural monitoring around the mail infrastructure itself.

The most important defensive question is consequently not simply whether malicious email content is being detected. It is whether the systems processing that email can themselves be manipulated by the content they receive. CVE-2026-73570 demonstrates how a service designed to receive messages from anyone on the Internet can become a direct route to operating-system command execution when input crosses an application boundary without proper sanitisation. Once active exploitation has been confirmed, patching is no longer routine maintenance; it is incident-prevention work that should be treated accordingly.

CERT Polska, the Polish Computer Emergency Response Team (CERT), warned that attackers have begun exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS). [...]

Source: Critical Zimbra RCE flaw now actively exploited in attacks via Bleeping Computer — published 20 Aug 2026.