Zimbra CVE-2026-73570: Unauthenticated Command Injection via SMTP

Basic Information

• Article Title: Actively exploited vulnerability in Zimbra Collaboration Suite
• Publisher: CERT Polska
• Publication Date: 2026-08-17
• Severity: Critical
• Original Source: CERT Polska
• Related Sources: Critical Zimbra RCE flaw now actively exploited in attacks, Hackers Target Zimbra Servers in Active Exploitation Campaign
• Related Malware: None / Unidentified
• Threat Actor: None / Unidentified
• CVE: CVE-2026-73570
• Products & Technologies: Zimbra Collaboration Suite, zimbra-snmp, snmp_notify, swatchdog
• Primary CVE: CVE-2026-73570

Summary in One Sentence

An actively exploited vulnerability allows attackers to send a crafted SMTP request to Zimbra servers with SNMP notifications enabled and execute OS commands as the zimbra user without authentication.

Reason for Severity: Attackers can reach the mail infrastructure without authentication, and active exploitation has been confirmed on the internet. Compromising a Zimbra server provides a foothold for accessing emails, credentials, and the internal network.

Attack Flow: Command Execution from SMTP

• An attacker finds a vulnerable server that is reachable via SMTP, has zimbra-snmp installed, and has SNMP notifications enabled.
• The attacker sends a crafted SMTP request to inject malicious strings into the service status notification.
• The swatchdog / SNMP notification process does not handle the strings safely and executes them as OS commands.
• The commands run with the privileges of the zimbra user and can place files in web directories or temporary directories.
• The attacker may proceed to install web shells, deploy additional tools, or retrieve emails and configuration data.

Attacker Position and Execution Location

• An unauthenticated attacker connecting to Zimbra's SMTP service from the internet.
• Command execution on the Zimbra server using the zimbra OS user privileges.
• Potential subsequent remote control of the server via web shells or external C2.

Visibility for Victims and Administrators

Victims / Users

No user action is required. Compromise can occur on the server side even if email sending and receiving appear normal.

Administrators / SOC

Clues include unusual "Service status change" entries in /var/log/zimbra.log, new files owned by the zimbra user, and child processes or outbound connections immediately following SMTP traffic.

Conditions for Success and Failure

Conditions for Success

• Vulnerable Zimbra has zimbra-snmp and SNMP notifications enabled.
• The attacker can reach the SMTP service.
• The zimbra user has write/execution permissions in accessible locations, and outbound network traffic is allowed.

Conditions for Failure

• Update to ZCS 10.1.20 or later.
• Disable the SNMP notification feature until patches are applied.
• Control SMTP exposure, process execution, web directory write access, and egress traffic.
• Detect crafted notifications early through log monitoring.

What Happens Upon Success

• Arbitrary OS commands executed with zimbra user privileges.
• Placement of web shells or additional malware.
• Access to emails, address books, configurations, and credentials.
• Establishment of a foothold in the internal network.

Observable Logs

Email

Check SMTP sessions and commands, not just normal incoming emails. Exploitation requests may not be delivered to user mailboxes.

Proxy / SWG / DNS

Tool downloads or C2 connections from the Zimbra server to unknown IP addresses or domains.

Endpoint / EDR

• Shells, curl / wget, and file