The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Zimbra Collaboration Suite (ZCS), identified as CVE-2026-73570, to its Known Exploited Vulnerabilities (KEV) catalog. This move mandates that all U.S. federal civilian executive branch (FCEB) agencies address the flaw by August 24, 2026, to protect their networks, and private organizations are also strongly advised to review and mitigate the vulnerability.
The flaw, an OS Command Injection vulnerability, allows an unauthenticated attacker to execute arbitrary shell commands with the privileges of the `zimbra` user. It affects ZCS instances where the SNMP trap service is enabled via the `snmp_notify` parameter and the `swatchdog` service is running. While the `zimbra-snmp` package is optional, the `swatchdog` service, which processes SNMP notifications, is enabled by default in most installations, expanding the potential attack surface.
CERT Polska, Poland's national computer emergency response team, confirmed active exploitation of CVE-2026-73570, prompting its inclusion in CISA's catalog. The technical root cause of the vulnerability is a sanitization failure within the SNMP monitoring component of Zimbra.
Zimbra released version 10.1.20 on July 20, 2026, to patch the issue. This means active exploitation was confirmed approximately 28 days after the fix became available.
CERT Polska has provided recommendations for organizations to detect potential exploitation. These include checking Zimbra logs located at `/var/log/zimbra.log` for specific entries indicating service status changes to "szkodliwy ładunek" (malicious payload). Additionally, organizations should verify for files created by the `zimbra` user within the last 30 days in the `/opt/zimbra/jetty/webapps/`, `/opt/zimbra/jetty_base/webapps/`, and `/tmp/` directories. Any discovery of such signs warrants immediate contact with a computer emergency response team.
