Zimbra Collaboration Suite has a problem that has moved well past the “security advisory” stage.
Attackers are actively exploiting a command-injection vulnerability that can give unauthenticated attackers the ability to execute operating-system commands on vulnerable mail servers. CISA has now added the flaw to its Known Exploited Vulnerabilities catalog and ordered U.S. federal agencies to remediate it.
- The Mess: CVE-2026-73570 affects Zimbra Collaboration Suite before version 10.1.20 when the optional
zimbra-snmppackage is installed and SNMP notifications are enabled. The flaw allows unauthenticated remote attackers to inject commands and execute them as thezimbrauser.
The interesting part is how little an attacker needs.
No valid Zimbra account.
No stolen password.
No elaborate social-engineering campaign.
The vulnerable configuration can expose a network-facing path that accepts attacker-controlled input. That input eventually reaches command execution without being properly constrained.
This is the sort of bug security teams hate because the attack path is brutally simple.
Zimbra is not a random desktop utility, either. It is collaboration and email infrastructure. Compromise the server and the attacker is sitting inside a system that can contain mailboxes, contacts, calendars, authentication data and a lot of information users assumed was private.
The vulnerability carries a CVSS score of 8.9, putting it firmly in high-severity territory. More importantly, the score is no longer the interesting part.
It is being exploited.
That changes the calculation.
A theoretical RCE is something administrators schedule into the next maintenance window.
An RCE being used against real systems is a fire alarm.
- What Actually Happened: Zimbra fixed CVE-2026-73570 in version 10.1.20, released on July 20, but threat actors subsequently began exploiting vulnerable installations in the wild. CERT Polska reported active exploitation, while CISA added the vulnerability to its KEV catalog.
The vulnerability is tracked as an OS command injection issue.
In practical terms, the attacker is abusing Zimbra’s handling of specially crafted input to cross the line between “data” and “instructions.”
That distinction is fundamental to application security.
A server should treat incoming network data as hostile until proven otherwise. If attacker-controlled characters can escape the intended input context and become shell commands, the application stops being an application and starts acting like a remote terminal.
The affected component is tied to Zimbra’s SNMP functionality.
That detail matters because not every Zimbra installation is necessarily exposed in the same way. Administrators need to check whether zimbra-snmp is installed and whether SNMP notifications are enabled rather than assuming every Zimbra server has identical exposure.
But do not turn that into an excuse for procrastination.
If you run Zimbra, check the configuration.
Then check the version.
Then patch.
CISA’s inclusion of the vulnerability in the KEV catalog is another warning sign. KEV is specifically about vulnerabilities that have evidence of exploitation, not hypothetical bugs sitting in a researcher’s notebook.
And the remediation deadline is immediate for affected U.S. government systems.
That tells you how seriously the vulnerability is being treated.
- The Damage: An unauthenticated attacker can potentially execute arbitrary operating-system commands on a vulnerable Zimbra server, turning an exposed mail system into an entry point for broader compromise.
Once command execution exists, the attacker does not necessarily stop at the first shell.
They can enumerate the server.
Look for credentials.
Inspect configuration files.
Move laterally.
Search mailboxes.
Drop persistence.
Use the compromised server as a foothold for attacks against other infrastructure.
The exact outcome depends on permissions, network segmentation and the rest of the environment. But the starting position is already bad enough.
An email server is one of the worst places to have an unauthenticated RCE.
It is internet-facing by design.
It stores sensitive information by design.
It communicates with people and systems outside the organization by design.
That makes it an attractive target.
There is also a nasty operational lesson here.
The patch has existed since July.
The exploitation became public later.
So the vulnerable window was not measured in hours. Administrators had time to update. Some systems still remained exposed.
That is how attackers turn old vulnerabilities into current incidents.
- The Fix: Upgrade Zimbra Collaboration Suite to 10.1.20 or later, verify whether
zimbra-snmpand SNMP notifications are enabled, and investigate logs for suspicious activity if the vulnerable configuration was exposed.
If patching cannot happen immediately, follow Zimbra’s vendor guidance and reduce exposure to the affected functionality.
And do not stop after installing the update.
Because this vulnerability has already been exploited, administrators should treat vulnerable servers as potentially targeted infrastructure, not simply machines waiting for a software upgrade.
Check authentication logs.
Check unusual command execution.
Check unexpected processes.
Check outbound connections.
Check administrator accounts.
If something looks wrong, investigate before declaring the server clean.
Bugstoday Verdict: An unauthenticated RCE in an internet-facing mail server is bad. An unauthenticated RCE that attackers are already using is not a “patch sometime this week” problem. It is a patch now problem.
