A critical remote code execution (RCE) vulnerability in Zimbra Collaboration Suite (ZCS), identified as CVE-2026-73570, is now being actively exploited by attackers. CERT Polska, the Polish Computer Emergency Response Team, issued a warning on Monday, August 17, 2026, confirming the in-the-wild exploitation of this flaw.
The vulnerability, a command injection weakness within the SNMP monitoring component, allows unauthenticated attackers to achieve RCE. This is possible when SNMP notifications are enabled, due to insufficient sanitization of untrusted input during SNMP notification processing. Attackers can send specially crafted SMTP requests that lead to the execution of arbitrary operating system commands under the privileges of the Zimbra user.
Zimbra, a widely used email and collaboration software, serves hundreds of millions of individuals and organizations globally, including thousands of businesses and hundreds of government agencies. The Zimbra security team addressed this flaw with the release of version 10.1.20 on July 20, 2026.
Internet security watchdog Shadowserver reports over 12,100 Zimbra servers are currently exposed online. The majority of these are located in Europe, with 4,382 servers, and Asia, with 4,492 servers. However, it remains unclear how many of these exposed servers are honeypots or have already been patched against CVE-2026-73570.
CERT Polska has advised administrators to inspect their logs for any suspicious activity over the past 30 days. Key indicators include unexpected restarts of the Zimbra service and the creation of new files by the 'zimbra' user in the `/opt/zimbra/jetty/webapps/`, `/opt/zimbra/jetty_base/webapps/`, and `/tmp/` directories.
Zimbra vulnerabilities are frequently targeted by threat actors. In February 2023, the Russian cyber espionage group Winter Vivern utilized a reflected cross-site scripting (XSS) exploit to steal emails from NATO-aligned entities via Zimbra webmail portals. In October 2024, US and UK cybersecurity agencies warned that APT29, also known as Midnight Blizzard or Cozy Bear, a group linked to Russia's Foreign Intelligence Service, was exploiting a previously known security issue in vulnerable Zimbra servers to steal email account credentials. More recently, in March, researchers from Seqrite Labs observed APT28, a state-backed group associated with Russia's military intelligence service, exploiting a stored XSS vulnerability in attacks against Ukrainian government ZCS servers.
