Zimbra already gives administrators enough reasons to keep a close eye on their servers.
Now there is another one.
CVE-2026-73570 allows an unauthenticated attacker to execute system commands on a vulnerable Zimbra Collaboration Suite server. CERT Poland detected attacks exploiting the flaw, while CISA ordered U.S. federal agencies to urgently patch it. The problem is particularly ugly because thousands of Zimbra servers are directly exposed to the Internet.
- The Mess: CVE-2026-73570 is a command-injection vulnerability in Zimbra’s SNMP notification component. An attacker does not need an account and, under the right configuration, can send a crafted request that results in operating-system command execution as the
zimbrauser.
The vulnerable software is Zimbra Collaboration Suite.
That means email.
Calendars.
Contacts.
User accounts.
Business data.
Basically, exactly the kind of server you don’t want random people experimenting with.
The vulnerability exists in the handling of SNMP notifications.
Sounds harmless.
It isn’t.
When SNMP notifications are enabled, specially crafted input can reach a component that fails to properly handle untrusted data.
The result?
Command execution on the server.
No login.
No password.
No employee needs to open a malicious attachment.
The attacker can target the server itself.
And that is already happening.
CERT Poland was among the organizations warning about attacks exploiting the vulnerability. CISA subsequently confirmed active exploitation and added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog.
That changes the priority.
This is not a theoretical bug sitting in a security database waiting for someone to care.
Attackers are already testing it.
- What Actually Happened: Zimbra fixed the vulnerability in version 10.1.20, released on July 20, 2026. Despite the available patch, Shadowserver identified more than 270 potentially compromised installations, while more than 12,000 Zimbra servers remained visible on the Internet.
And here comes the familiar problem.
The patch exists.
The attacks exist.
Thousands of servers are still exposed.
An administrator sees the update, postpones it because the mail server is working, users are busy, and nobody wants to touch production.
The attacker doesn’t care.
Automated scanners don’t take weekends off.
If a server responds on the Internet, it can be scanned.
If it is vulnerable, exploitation can be attempted.
And if the exploit is simple enough, the entire process can be automated.
Zimbra is particularly attractive because a compromised mail server contains exactly the kind of information attackers want.
User accounts.
Emails.
Attachments.
Contacts.
Authentication data.
Internal infrastructure details.
Potentially credentials that can be reused elsewhere.
A compromised mail server should therefore never be treated as “just another Linux box.”
It can be one of the most valuable systems in the entire organization.
- The Damage: Successful exploitation can give a remote, unauthenticated attacker the ability to execute commands on a Zimbra server, potentially leading to stolen email, credentials, sensitive data and further compromise of the internal network.
And there is another problem.
An attacker who gets command execution does not have to immediately start deleting things.
That would be stupid.
A quieter attacker can first gather information.
List users.
Inspect configuration.
Search for credentials.
Identify internal services.
Check what the server can reach.
Look for SSH keys.
Then move.
That means installing the patch is not necessarily the end of the incident.
If the server was vulnerable and Internet-facing while exploitation was active, administrators should consider the possibility that somebody already got in.
Review logs.
Check running processes.
Look for unexpected files.
Inspect outbound connections.
Look for new accounts.
Check for modified configuration.
Search for indicators of persistence.
Because a patch fixes the vulnerability.
It does not undo a compromise.
- The Fix: Upgrade Zimbra Collaboration Suite to 10.1.20 or later, restrict unnecessary access to exposed services, and investigate the server for signs of previous exploitation.
If SNMP notifications are not required, review whether they can be disabled.
But don’t treat that as a replacement for patching.
The update is the real fix.
If the server was exposed to the Internet, investigate it.
CERT Poland observed real exploitation attempts, while Shadowserver identified hundreds of potentially compromised installations.
And if credentials were accessible from the server, assume they may need to be rotated.
Especially administrative credentials.
Especially credentials reused anywhere else.
Bugstoday Verdict: An unauthenticated RCE on a mail server isn’t “another vulnerability to patch.” It’s a potential front door to an organization’s correspondence and internal infrastructure. If your Zimbra server is still running an old version, stop postponing the update.
