CERT Polska has confirmed active exploitation of a critical unauthenticated remote code execution vulnerability in Zimbra Collaboration Suite, identified as CVE-2026-73570. The flaw, which allows attackers to execute arbitrary shell commands with the privileges of the `zimbra` user, was patched by Zimbra on July 20, 2026, in version 10.1.20. Active exploitation was confirmed less than a month later, on August 21, 2026.
The vulnerability stems from a sanitization failure within Zimbra's SNMP monitoring component. It specifically affects instances where the optional `zimbra-snmp` package is installed, SNMP trap notifications are enabled via the `snmp_notify` parameter, and the `swatchdog` service is running. While `zimbra-snmp` is an optional package, the `swatchdog` service, which processes SNMP notifications, is enabled by default on most Zimbra installations.
Given the ongoing exploitation campaign, CERT Polska has issued recommendations for administrators to verify their Zimbra logs and file systems for indicators of compromise. They advise checking `/var/log/zimbra.log` for entries indicating a service status change where a malicious payload transitions from "stopped" to "running" and back, which signifies command execution. Additionally, administrators should inspect the directories `/opt/zimbra/jetty/webapps/`, `/opt/zimbra/jetty_base/webapps/`, and `/tmp/` for any files created by the `zimbra` user within the last 30 days, as these could indicate dropped web shells for persistent access.
The exposure to this vulnerability is significant, with over 12,100 Zimbra servers currently reachable from the internet, according to Shadowserver. Europe and Asia each account for approximately 4,400 of these exposed servers. This figure does not differentiate between patched and unpatched instances or between production servers and honeypots, meaning the actual attack surface is likely smaller but still substantial.
Zimbra solutions have historically been targets for sophisticated threat actors. Previous incidents include exploitation by the Russian espionage group Winter Vivern in February 2023, which used a reflected XSS flaw to steal emails from NATO-aligned organizations. In October 2024, US and UK agencies warned of APT29, linked to Russia's Foreign Intelligence Service, targeting vulnerable Zimbra servers to steal credentials. More recently, in March 2026, APT28, associated with Russian military intelligence, exploited a stored XSS vulnerability against Ukrainian government Zimbra deployments.
The current vulnerability, CVE-2026-73570, presents a particularly high risk due to its unauthenticated nature, the default activation of the vulnerable service component, and the large number of internet-exposed Zimbra servers. Organizations, especially those in sectors frequently targeted by state-backed groups, are urged to prioritize patching and implement the recommended checks to mitigate the threat.
