CERT Polska reported active exploitation of CVE-2026-73570, a critical remote code execution vulnerability in Zimbra Collaboration Suite. The vulnerability is due to a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled. An unauthenticated attacker can send specially crafted SMTP requests that lead to arbitrary OS command execution as the Zimbra user. The Zimbra security team released version 10.1.20 on July 20, 2026, to patch this issue. Shadowserver tracks over 12,100 internet-exposed Zimbra servers, with many located in Europe and Asia, though it is unclear how many are patched. CERT Polska advises administrators to monitor logs for suspicious activity such as service restarts and unexpected file creation in key directories. Zimbra has been frequently targeted by state-backed threat actors in the past.

The vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands with the privileges of the Zimbra user, potentially leading to full compromise of the affected server. This can result in unauthorized access, data theft, service disruption, and further lateral movement within networks. Given the widespread use of Zimbra in businesses and government agencies, exploitation can have significant operational and confidentiality impacts.

A security update fixing this vulnerability is available in Zimbra Collaboration Suite version 10.1.20 released on July 20, 2026. Administrators should apply this official patch immediately. Additionally, CERT Polska recommends checking logs for suspicious activities such as unexpected Zimbra service restarts and the presence of unusual files in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ directories created by the Zimbra user within the last 30 days. No alternative mitigations or workarounds are specified. Patch status is confirmed by the vendor advisory.