Zimbra CVE-2026-73570: Unauthenticated SNMP Command Injection Exploited

·

CVE-2026-73570 (CVSS 8.9) is an unauthenticated OS command injection in Zimbra Collaboration Suite. When the optional zimbra-snmp package is installed and SNMP notifications are enabled, attacker-controlled data reaches the SNMP notification processing path without adequate sanitisation — letting a remote, unauthenticated actor execute operating system commands as the zimbra user.

Zimbra fixed the flaw in ZCS 10.1.20. CERT Polska reported active exploitation on August 17, 2026, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 21 with a three-day federal remediation deadline. Public reporting since then counts more than 274 compromised servers across 17 countries.

◈ Table of Contents

01 Background & Affected Products 02 Exploitation Path 03 Exploitation Timeline & Scope 04 Detection & Hunt Queries 05 Mitigation & Patching 06 MITRE ATT&CK Mapping 07 Sources & References
🧩

Background & Affected Products

Phase 01

Zimbra Collaboration Suite (ZCS) is an email and groupware platform run by service providers, universities, and public-sector bodies — the same profile of internet-exposed mail infrastructure that has repeatedly drawn nation-state and criminal attention. CVE-2026-73570 continues that pattern: a pre-authentication path to command execution on the mail server itself.

The weakness is CWE-78 (OS command injection). It lives specifically in the SNMP monitoring component, which is not part of a default install — it depends on the optional zimbra-snmp package and enabled SNMP notifications. That optionality is the single most important triage question for defenders: instances without the package are not exploitable through this path.

AttributeValue
CVE IDCVE-2026-73570
CVSS v3.18.9   High
WeaknessCWE-78 — OS Command Injection
AffectedZCS before 10.1.20 with zimbra-snmp installed and SNMP notifications enabled
Fixed versionZCS 10.1.20
AuthenticationNone — pre-auth, no user interaction
Executes aszimbra service user
CISA KEVAdded August 21, 2026 — 3-day federal remediation deadline

Do not assume you are safe because "we don't use SNMP." Confirm it. Many Zimbra estates were provisioned from templates or migrations that pulled in zimbra-snmp, snmp_notify, and swatchdog without operators realising it.

⚙️

Exploitation Path

Phase 02

Public advisories describe the mechanism at a high level: specially crafted SMTP requests deliver attacker-controlled data that eventually reaches Zimbra's SNMP notification processing. Because that data is not properly neutralised before being used in an OS command context, what should have stayed inert input becomes command execution.

Data-flow view — untrusted SMTP input crosses into a command context via the SNMP path

CyberHawk is deliberately not publishing a working request or payload for this flaw. The defensive facts — affected component, execution context, and detection surface — are enough to act on. Never post exploit strings for a mail server under active mass exploitation.

The execution context is the whole story for scoping: commands run as zimbra, which owns the mail store, config, and LDAP bind material. A successful hit should be treated as full mail-server compromise, not a limited foothold.

📈

Exploitation Timeline & Scope

Phase 03
Date (2026)Event
Aug 13CVE-2026-73570 published in NVD (CVSS 8.9)
Aug 17CERT Polska reports active in-the-wild exploitation
Aug 21CISA adds CVE to KEV catalog with 3-day federal deadline
Late AugReporting counts 274+ compromised servers across 17 countries
🛰️ CERT Polska — active exploitation reporting National CERT advisory · cert.pl ↗

The compressed sequence — patch, then confirmed exploitation, then a KEV listing with a three-day clock — is the signature of a bug that attackers weaponised quickly against a known-exposed population. Zimbra's history of post-patch exploitation windows means "we'll get to it" is not an acceptable posture here.

🔎

Detection & Hunt Queries

Phase 04

No public IOCs (IPs, hashes, or domains) were disclosed, so detection is behavioural and configuration-based. The two anchors are: (1) is the vulnerable component present, and (2) is the zimbra user spawning processes it never legitimately spawns — shells, downloaders, or reverse-shell tooling triggered from the SNMP/notification path.

Shell — exposure check on the Zimbra host
# Is the vulnerable SNMP component installed? $ su - zimbra -c 'zmcontrol -v' # confirm version vs 10.1.20 $ rpm -qa | grep -Ei 'zimbra-snmp' # or: dpkg -l | grep zimbra-snmp $ ls -la /opt/zimbra/ | grep -Ei 'snmp|swatch' # Look for suspicious children of zimbra-owned mail/notify processes $ ps -ef | grep -Ei 'snmp_notify|swatch' | grep -v grep
DETECTS: the zimbra service account spawning interactive shells or network utilities — the tell of command injection turning into execution.
KQL — Microsoft Sentinel / Defender (Linux via MDE)
// zimbra user launching shells or downloaders DeviceProcessEvents | where AccountName == "zimbra" | where FileName in ("bash","sh","curl","wget","nc","ncat","python3","perl") | where InitiatingProcessCommandLine has_any ("snmp","swatch","notify") | project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine | order by Timestamp desc
SPL — Splunk (Linux auditd)
# zimbra spawning suspicious child processes index=linux sourcetype=linux:audit user=zimbra process_name IN (bash,sh,curl,wget,nc,ncat,python3,perl) | stats count min(_time) as first max(_time) as last values(process) as cmd by host,parent_process_name | sort - last
SPL — Splunk (mail transaction spike into SNMP path)
index=mail sourcetype=zimbra:mailbox (snmp OR notify OR swatch) | timechart span=15m count by host | where count > 0

If SNMP notifications are not a business requirement, disabling them removes the exploit surface and simplifies detection — any process activity from the notify path afterwards is inherently suspicious.

🛡️

Mitigation & Patching

Phase 05
1 Upgrade to ZCS 10.1.20 Priority

Applying ZCS 10.1.20 is the authoritative fix. Given confirmed active exploitation and a national-CERT advisory, treat this as an emergency change and patch ahead of your normal maintenance window.

2 Reduce the SNMP attack surface Interim
  • 1Confirm whether zimbra-snmp, snmp_notify, and swatchdog are present; if SNMP monitoring is not required, remove or disable the component.
  • 2Restrict inbound SMTP and management access to trusted networks where operationally feasible.
  • 3Ensure the zimbra user has no unnecessary sudo rights and tight egress filtering to blunt second-stage payloads.

    • Disabling SNMP is a stopgap, not a substitute for patching. Re-enable only after upgrading to 10.1.20.

    3 Assume-compromise triage if exposed IR
  • 1Review process ancestry for shells or downloaders spawned by zimbra during the exposure window.
  • 2Hunt for new webshells, cron jobs, SSH keys, and modified startup items owned by zimbra.
  • 3Rotate any credentials the mail server holds — LDAP bind, service accounts, API keys — if compromise is suspected.
    • 🎯

    MITRE ATT&CK Mapping

    Phase 06
    TacticTechniqueHow it appears here
    Initial AccessT1190Exploit Public-Facing Application — the exposed Zimbra mail service
    ExecutionT1059Command & Scripting Interpreter — OS commands via the SNMP notify path
    PersistenceT1505.003Server Software Component: Web Shell — common follow-on after mail-server RCE
    📚

    Sources & References

    Phase 07
    NVD — CVE-2026-73570 record (CVSS 8.9, CWE-78) CISA — Known Exploited Vulnerabilities Catalog CERT Polska — active exploitation advisory SOCRadar — CVE-2026-73570 Zimbra RCE analysis RedLegg — Security bulletin: Zimbra SNMP command injection Zimbra — Security Center / advisories

    Mail servers are prime targets — treat this as an emergency. Confirm your ZCS version and SNMP posture today, patch to 10.1.20, and run CyberHawk's IOC Scanner across your mail estate. Track fast-moving KEV additions on the CyberHawk Threat Intel feed.

    ◈ Stay Connected

    Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.

    🌐 Website ▶️ YouTube ▶️ YouTube (2) 𝕏 Twitter / X ♪ TikTok ✈️ Telegram
    🔍 IOC Scanner 🛠️ Live Tools 📚 Courses 🚨 Threat Intel 📝 Blog 📋 SOPs

    "They can't exploit you if you are the Exploit."