CVE-2026-73570 is a remote code execution vulnerability in Zimbra Collaboration Suite's SNMP monitoring component caused by improper sanitization of untrusted input during SNMP notification processing. An unauthenticated attacker can send specially crafted SMTP requests that trigger command injection, resulting in arbitrary OS command execution as the Zimbra user. The vulnerability was patched in version 10.1.20 on July 20, 2026. CERT Polska reported active exploitation in the wild, prompting CISA to mandate urgent patching for U.S. federal civilian agencies within three days. The vulnerability affects Zimbra servers with SNMP notifications enabled and exposed to the internet. Detection recommendations include monitoring for unexpected Zimbra service restarts and suspicious file creation in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ folders.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands with the privileges of the Zimbra user, potentially leading to full compromise of the affected Zimbra server. Given the widespread use of Zimbra in government and enterprise environments, this vulnerability poses a significant risk to sensitive email and collaboration data. Active exploitation in the wild has been confirmed by CERT Polska and CISA, increasing the urgency of remediation.

A security update fixing this vulnerability is available in Zimbra Collaboration Suite version 10.1.20, released on July 20, 2026. Organizations should apply this patch immediately. CISA has mandated U.S. federal civilian agencies to patch within three days. Additionally, administrators should verify whether SNMP notifications are enabled and consider disabling them if not required. Monitoring logs for unexpected Zimbra service restarts and checking for suspicious file creation in the specified directories can aid in detecting exploitation attempts. Patch status is confirmed; immediate application of the official fix is recommended.