Zimbra has confirmed that a serious security issue affecting its Collaboration Suite is being actively exploited, according to a bulletin from Poland’s CERT Polska. The vulnerability, tracked as CVE-2026-73570, allows unauthenticated attackers to execute arbitrary commands on servers running a vulnerable version of Zimbra with SNMP notifications enabled. The flawed functionality resides in the optional zimbra-snmp package and impacts all ZCS instances predating version 10.1.20.([thehackernews.com](https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html))
How the Flaw Works and What’s at Risk
The issue stems from deficient input filtering during SNMP notification processing. An attacker can send manipulated SNMP notifications that are incorrectly treated as safe, triggering execution of operating-system commands under the privileges of the Zimbra user. This means full takeover is possible if SNMP notifications are enabled and the optional package is active.([thehackernews.com](https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html))
Zimbra’s patch in version 10.1.20, released in July 2026, addressed this command-injection weakness. Administrators are therefore encouraged to update immediately if they’re running earlier versions.([thehackernews.com](https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html))
Signs of Exploitation and Related Threats
CERT Polska warns that there are ongoing misuse attempts in the wild. Indicators include unexpected restarts of Zimbra service processes and recently created files under /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/, all logged in /var/log/zimbra.log.([thehackernews.com](https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html))
The security advisory also draws connections to earlier campaigns involving the Russian-linked actor “Laundry Bear” (also known by aliases such as TA488 and Void Blizzard). That group made use of a different flaw—CVE-2025-66376—a zero-click stored cross-site scripting vulnerability in Zimbra’s Classic UI. Attackers leveraged it as far back as mid-2025 to harvest email content and sensitive data without any user interaction beyond viewing the message.([thehackernews.com](https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html))
While the two vulnerabilities are distinct, their combination underscores the persistent risk posed by Zimbra servers exposed to the internet when outdated or improperly configured. One allows remote, unauthenticated RCE via SNMP; the other delivers browser-based spear-phishing without clicks. Both achieve serious intrusion consequences.([thehackernews.com](https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html))
Admins need to confirm whether the zimbra-snmp package is installed and whether SNMP notifications are active. If so—and especially if the server is accessible from outside trusted networks—it should be upgraded to version 10.1.20 without delay. Until the patch is applied, monitoring logs and file changes in key directories are crucial for detecting exploitation.([thehackernews.com](https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html))
In light of this development, organizations using Zimbra must treat this as a serious threat. This exploit not only breaks into email systems but insults the integrity of critical internal communications. Expect regulatory scrutiny where email confidentiality is mandated, and compliance efforts should be reviewed too. Watch how threat intelligence groups expand on this, whether proof-of-concept code becomes public, and how vendors like Zimbra tighten monitoring and disclosure policies.
Ultimately, this is a reminder that auxiliary components—optional monitoring packages, legacy UI features, seldom-used protocols—often hide the biggest risks. The time to patch is now: delay could expose servers to compromise long after a fix exists.
