A newly identified flaw in the Zimbra Collaboration Suite is being actively exploited, putting internet-facing email servers at serious risk. CERT Polska has issued an urgent alert around CVE-2026-73570, a critical OS command injection vulnerability that permits attackers to run arbitrary shell commands as the “zimbra” user without needing valid login credentials. ([cybersecuritynews.com](https://cybersecuritynews.com/zimbra-collaboration-suite-vulnerability-exploited/))
What the Vulnerability Is
The vulnerability stems from the interaction between two Zimbra components: the SNMP trap service (activated via the “snmp_notify” parameter) and the swatchdog service. By default, swatchdog is enabled, meaning that many setups become vulnerable if SNMP notifications are also in use. In affected installations, attackers can execute malicious commands, modify or add files, drop web shells, steal emails, gain persistence, or pivot laterally within compromised networks. ([cybersecuritynews.com](https://cybersecuritynews.com/zimbra-collaboration-suite-vulnerability-exploited/))
Active Exploitation and Severity
CERT Polska has observed this flaw in active exploitation campaigns targeting vulnerable Zimbra deployments. Since the vulnerability allows remote, unauthenticated access, affected organizations could suffer full server compromise with minimal interaction. ([cybersecuritynews.com](https://cybersecuritynews.com/zimbra-collaboration-suite-vulnerability-exploited/))
Patching, Mitigation, and Detection
Zimbra has released version 10.1.20, which fixes CVE-2026-73570. Administrators are advised to verify their current Zimbra version and apply the update immediately. If immediate patching isn’t possible, disabling SNMP trap functionality or turning off the “snmp_notify” setting can reduce exposure. ([cybersecuritynews.com](https://cybersecuritynews.com/zimbra-collaboration-suite-vulnerability-exploited/))
To detect potential compromise, teams should review Zimbra logs for suspicious service status changes (e.g. between “running” and “stopped”) and inspect the /var/log/zimbra.log file. Particular attention should go to directories where web apps are stored—like /opt/zimbra/jetty/webapps/ and /opt/zimbra/jetty_base/webapps/—as attackers often install JSP web shells in locations intended for web applications. Also look at /tmp/ for unexpected files belonging to the zimbra user. Changes in the last 30 days should be scrutinized—especially for obfuscation, strange names, executable scripts, unauthorized JSP files, or outbound network activity. ([cybersecuritynews.com](https://cybersecuritynews.com/zimbra-collaboration-suite-vulnerability-exploited/))
If evidence of compromise is found, isolating the affected server, preserving logs and suspicious files for forensic analysis, rotating exposed credentials, and checking connected systems for lateral movement are essential actions. CERT Polska also encourages reporting signs of exploitation to its incident response team. ([cybersecuritynews.com](https://cybersecuritynews.com/zimbra-collaboration-suite-vulnerability-exploited/))
This vulnerability underscores how email infrastructure continues to be a favored target. Organizations relying on Zimbra should treat this as an urgent patch-management priority—not a routine maintenance update. Neglecting it could lead to severe breaches or long-term intrusions. ([cybersecuritynews.com](https://cybersecuritynews.com/zimbra-collaboration-suite-vulnerability-exploited/))
