Zimbra RCE Actively Exploited: Mail Servers at Risk via SNMP

Published on 4 September 2026

A single crafted connection attempt to your mail server – and an unauthenticated attacker executes operating system commands as if sitting directly at the console. That is exactly what a currently actively exploited vulnerability in Zimbra Collaboration makes possible – a widely used server software for email, calendaring and webmail. The flaw is tracked as CVE-2026-73570, is already being attacked on a large scale, and was added to the US CISA's Known Exploited Vulnerabilities (KEV) catalogue on 21 August 2026. If you run your own Zimbra mail server, you should act now.

What happened?

An OS command injection is being reported for Zimbra Collaboration versions prior to 10.1.20 – a vulnerability in which an attacker can inject their own operating system commands into a program via manipulated input. In the case of CVE-2026-73570, this happens through the processing of SNMP notifications. SNMP (Simple Network Management Protocol) is a standard for the technical monitoring of servers.

The insidious part: the attack works without authentication. An attacker simply sends specially crafted SMTP requests – that is, requests via the protocol used to exchange emails between servers. If this input is not sufficiently sanitized in the SNMP notification processing, it ends up in operating system commands, which are then executed with the privileges of the zimbra user. The MITRE Corporation describes the sequence in the official CVE entry as follows:

„Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.“ (MITRE Corporation, CVE Program)

The flaw is classified as CWE-78 (OS Command Injection) and rated with a CVSS v3.1 score of 8.9 (High) – on a scale up to 10, therefore in the upper range.

Important for understanding who is affected: the vulnerability only takes effect under a specific configuration. The optional zimbra-snmp package must be installed and SNMP notifications (SNMP traps) must be enabled. CERT Polska specifies the configuration observed in the wild as enabled SNMP traps via snmp_notify with an active swatchdog (a monitoring service). Not every internet-exposed Zimbra instance is therefore automatically vulnerable – but every one that meets these prerequisites and is not patched is.

The timeline: fast and serious

The chronology shows how quickly a patch turned into an acute emergency:

• 20 July 2026: Zimbra releases version 10.1.20. The release notes cite a fix for a command injection in the SNMP monitoring component when SNMP notifications are enabled.
• 13 August 2026: CVE-2026-73570 is officially published by MITRE.
• 17 August 2026: CERT Polska reports the active exploitation in advisory 145/2026 and names concrete indicators for retrospective analysis.
• 19 August 2026: The Centre for Cybersecurity Belgium (CCB) warns of an ongoing attack campaign.
• 21 August 2026: CISA adds the flaw to the KEV catalogue based on evidence of active exploitation. For US federal agencies, 24 August 2026 was set as the deadline.

The CCB puts it unambiguously:

„Security researchers have identified an ongoing campaign that is actively exploiting this vulnerability.“ (Centre for Cybersecurity Belgium)

Who is affected?

Affected are organizations that run their own Zimbra mail server in a version prior to 10.1.20 – specifically when the zimbra-snmp package is installed and SNMP notifications are enabled. This typically affects SMEs, public authorities, associations and educational institutions that host their email infrastructure themselves or have it operated by an IT service provider.

Not immediately affected by this specific server vulnerability is anyone who merely uses website hosting without running their own Zimbra mail server. If you are unsure whether Zimbra is running in your infrastructure, ask your IT service provider specifically about it.

As for the scope, there is no reliable figure of confirmed vulnerable or compromised organizations. According to a report from 20 August 2026, the security service Shadowserver tracked more than 12,100 internet-exposed Zimbra servers, of which 4,382 were in Europe and 4,492 in Asia. This figure, however, must expressly not be understood as a victim or vulnerability count: it is unknown how many of them are honeypots (systems deliberately set up as bait) or have already been patched. No published proof-of-concept or detailed exploit code was named in the sources reviewed – the active exploitation is nevertheless documented by CERT Polska, CCB and CISA.

How to check whether you are affected

Work through the following steps systematically – ideally together with your IT service provider:

1. Create an inventory: Record all Zimbra servers operated by you or your service providers, in particular MTA, proxy and mailbox nodes with SMTP reachability.
2. Check the version: Log in to each Zimbra node as the zimbra user and run /opt/zimbra/bin/zmcontrol -v. This command shows the release, build and platform. If the installation is prior to 10.1.20, there is potential exposure.
3. Check the service status: Run /opt/zimbra/bin/zmcontrol status and check whether the snmp service is present or active.
4. Check the SNMP configuration: As administrator, check whether the zimbra-snmp package is installed and whether SNMP notifications or SNMP traps are enabled. The decisive factor is enabled SNMP notifications; CERT Polska additionally names snmp_notify and the swatchdog that is active by default. If anything is unclear, treat the server as urgently requiring examination.
5. Compromise check: Search /var/log/zimbra.log for entries matching the pattern Service status change: <malicious payload> changed from stopped to running or running to stopped. Also check for files created by the zimbra user in the last 30 days under /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/ and /tmp/. These are the indicators published by CERT Polska.

An unobtrusive check is no substitute for a deeper forensic assessment – but it gives you an important initial orientation.

What you need to do now

1. Patch immediately: Update affected instances with the highest priority to Zimbra Collaboration 10.1.20 or a later supported version. The fix has been available since 20 July 2026. Perform a full backup before patching – Zimbra explicitly points out that there is no automated rollback.
2. Observe the role order: The vendor's instructions require updates on all ZCS servers in the order LDAP, LDS, MTA, Proxy and Mailbox. If SNMP is installed, update zimbra-snmp-components before the restart. The package installation differs between RHEL and Ubuntu systems – follow the official instructions.
3. Emergency measure if immediate patching is not possible: Reduce the attack surface in the short term by controlled deactivation of SNMP notifications or the SNMP service, provided your monitoring requirements allow it. This measure does not replace the patch, but it buys time. Document it and coordinate it with your service provider.
4. Preserve and examine traces: Preserve log and system artefacts from changes, check the CERT Polska indicators and increase monitoring and detection. This is crucial because – as the CCB states – patching does not remediate a compromise that has already occurred.
5. If suspected: initiate incident response: Determine which mailboxes, personal data, credentials and connected systems could be affected. Only on this basis can password resets, token revocations, communication and a data protection notification decision be made appropriately.

Why a compromised mail server is so dangerous

A mail server is not just any IT system – it continuously processes emails, attachments, address book data and often credentials as well. If it is taken over, an attacker gains access to a central nerve centre of corporate communication.

A comparison shows how attractive Zimbra servers are as a target: a joint CISA agency advisory from 23 July 2026 documented for a different Zimbra vulnerability (CVE-2025-66376) a campaign ongoing since at least July 2025 against Western government and commercial organizations. After successful exploitation, the attackers attempted, among other things, to siphon off emails from the last 90 days, passwords, global address lists, 2FA tokens and app passcodes. This is no proof of a data leak through CVE-2026-73570 – but it illustrates the damage that threatens with a compromised mail server.

GDPR: What you must observe from a data protection perspective

The mere existence of the vulnerability is not yet a data protection breach. However, if your mail server is successfully compromised and personal data is affected, a breach of the protection of personal data within the meaning of Art. 4(12) GDPR is regularly indicated. In that case, as the controller you must immediately carry out a documented risk assessment.

Concretely, this means:

• Art. 32 GDPR requires appropriate technical and organizational measures – timely patching is part of that.
• Art. 33 GDPR: If there is likely to be a risk to the rights and freedoms of natural persons, the competent supervisory authority must be notified without undue delay and, where feasible, within 72 hours of becoming aware. According to the BfDI expert forum, this deadline also runs over weekends; a late notification must be justified.
• Art. 34 GDPR: If there is a high risk, the affected persons must be informed without undue delay.

In addition: Art. 82 GDPR governs claims for damages by affected persons. For breaches of obligations under Art. 25 to 39 – and thus also against Art. 32 – Art. 83(4) GDPR permits fines of up to EUR 10 million or up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher. There is no fixed standard fine: the nature, gravity and duration of the breach, the data affected, the measures taken, cooperation and notification are assessed on a case-by-case basis.

Assessment: How serious is the situation?

High and time-critical. Under the described configuration prerequisites, the flaw allows unauthenticated command execution via SMTP and, according to CERT Polska, CCB and CISA, is already being actively exploited. Affected is not only the webmail interface, but the mail server as a system – and thus potentially the confidentiality, integrity and availability of your entire business communication. The CVSS rating of 8.9 and the KEV listing underscore the operational urgency.

The good news: not every Zimbra instance is necessarily vulnerable, because zimbra-snmp and enabled SNMP notifications are prerequisites. But the clear consequence is: Every ZCS environment not updated to 10.1.20 should be checked immediately.

Conclusion

CVE-2026-73570 is a case study in how quickly an available patch turns into an active emergency. Zimbra provided the fix as early as 20 July 2026 – just a few weeks later attacks are running worldwide. Anyone who acts promptly now is on the safe side; anyone who waits risks a compromise that cannot subsequently be reversed by patching.

Check today whether you run a Zimbra server, which version it is running and whether SNMP is enabled. Create a backup, apply the update to 10.1.20 and, in parallel, check the indicators named by CERT Polska. Should you find signs of suspicion, immediately activate your incident response process and review your data protection notification obligations. If you have your mail infrastructure operated by a service provider, request written confirmation of the patch status – concrete and with a date.