![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/user-icon.svg\"){kind=icon}
Pierluigi Paganini<\/a>\n\t\t\t\t\t\t\t
![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/clock-icon.svg\"){kind=icon}
August 21, 2026<\/p>\n\t\t\t\t\t\t![\"\"\/](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/08\/zimbra.png\")
<\/p>\n
CERT Polska confirmed active exploitation of CVE-2026-73570, a critical unauthenticated RCE in Zimbra Collaboration Suite patched on July 20.<\/p>\n
CERT Polska, Poland\u2019s national computer emergency response team, confirmed this week that threat actors are actively exploiting a critical vulnerability in Zimbra Collaboration Suite tracked as CVE-2026-73570. The flaw allows unauthenticated remote code execution and was patched less than a month ago.<\/p>\n
\u201cThe CERT Polska team informs about an actively exploited OS Command Injection vulnerability in Zimbra Collaboration Suite.\u201d reads the advisory<\/a> published by CERT Polska. \u201cThe vulnerability, identified as\u00a0CVE-2026-73570<\/a>\u00a0, allows an unauthenticated attacker to execute arbitrary shell commands with the privileges of\u00a0the zimbra\u00a0user . The vulnerability affects instances that have the SNMP trap service enabled via the\u00a0\u00a0snmp_notify\u00a0parameter \u00a0and the swatchdog service running (enabled by default).\u201d<\/p>\n The vulnerability affects systems with SNMP trap notifications enabled and the swatchdog service running, which is enabled by default. The technical root cause is a sanitization failure in the SNMP monitoring component. <\/p>\n Zimbra released version 10.1.20 on 20 July 2026 to address the issue. The fix came 28 days before active exploitation was confirmed, which is not a wide window, but apparently wide enough.<\/p>\n The attack surface only exists when the optional zimbra-snmp package is installed and SNMP notifications are active, but swatchdog, the service that processes those notifications, is running by default on most installations.<\/p>\n Below are recommendations by CERT Polska:<\/p>\n \u201cDue to the ongoing campaign exploiting this vulnerability, we recommend:<\/p>\n verifying Zimbra logs\u00a0\/var\/log\/zimbra.log\u00a0for the following entries:<\/p>\n Service status change: changed from stopped to running verification of files created by user zimbra\u00a0in the last 30 days\u00a0in the following directories:<\/p>\n \/opt\/zimbra\/jetty\/webapps\/ If you discover any signs of potential exploitation of this vulnerability, please contact our team immediately.\u201d<\/p>\n The exposure numbers aren\u2019t reassuring. Shadowserver currently tracks<\/a> over 12,100 Zimbra servers reachable from the Internet, split roughly between Europe (4,382) and Asia (4,492). That figure doesn\u2019t distinguish between patched and unpatched instances, or between production servers and honeypots, so the real attack surface is smaller, but nobody knows by how much.<\/p>\n CERT Polska published indicators of compromise alongside the advisory and gave administrators specific places to look. The team recommends checking \/var\/log\/zimbra.log for service status change entries where the payload transitions from stopped to running and back, which is the signature of a malicious command being executed as a service. Admins should also check whether any files were created in \/opt\/zimbra\/jetty\/webapps\/, \/opt\/zimbra\/jetty_base\/webapps\/, or \/tmp\/ by the zimbra user in the last 30 days. Web shells dropped into those directories would give persistent access after the initial command injection.<\/p>\n CVE-2026-73570 isn\u2019t yet in CISA\u2019s Known Exploited Vulnerabilities catalog, which currently lists 18 Zimbra Collaboration Suite entries, four of them added this year. The absence doesn\u2019t mean the threat is lower; it means the catalog hasn\u2019t caught up yet.<\/p>\n Zimbra solutions have been targeted by nation-state actors for years. Russian espionage group Winter Vivern<\/a> exploited a reflected XSS flaw in February 2023 to steal emails from NATO-aligned organizations through Zimbra webmail portals. In October 2024, US and UK agencies warned that APT29<\/a>, linked to Russia\u2019s Foreign Intelligence Service, was targeting vulnerable Zimbra servers via a credential-stealing flaw. Most recently, in March 2026, Seqrite Labs researchers documented APT28, tied to Russian military intelligence, exploiting a stored XSS vulnerability against Ukrainian government Zimbra deployments.<\/p>\n Organizations in sectors targeted by Russian or Chinese state-backed groups should treat unpatched Zimbra servers as a high priority. CVE-2026-73570 is especially risky because attackers can exploit it without authentication, the vulnerable service is enabled by default, and many Zimbra servers are exposed online. These conditions make the flaw an attractive target for rapid exploitation.<\/p>\n Follow me on Twitter:\u00a0@securityaffairs<\/a>\u00a0and\u00a0Facebook<\/a>\u00a0and\u00a0Mastodon<\/a><\/p>\n
\nService status change: changed from running to stopped<\/p>\n
\n\/opt\/zimbra\/jetty_base\/webapps\/
\n\/tmp\/<\/p>\n