Full Report
A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska). The vulnerability in question is CVE-2026-73570 (CVSS score: 8.9), which refers to a case of command injection that can lead to remote code execution. "A remote code execution vulnerability exists in Zimbra
Analysis Summary
# Vulnerability: Zimbra Collaboration SNMP Command Injection
## CVE Details
- **CVE ID:** CVE-2026-73570
- **CVSS Score:** 8.9 (High/Critical)
- **CWE:** CWE-77 (Improper Neutralization of Special Elements used in a Command) / CWE-94 (Improper Control of Generation of Code)
## Affected Systems
- **Products:** Zimbra Collaboration (ZCS)
- **Versions:** All versions prior to 10.1.20
- **Configurations:** Systems where the optional `zimbra-snmp` package is installed and SNMP notifications are enabled.
## Vulnerability Description
A command injection vulnerability exists in Zimbra Collaboration due to improper sanitization of untrusted input during the processing of SNMP notifications. An unauthenticated attacker can exploit this by sending specially crafted SMTP requests. Because the input is not correctly filtered, it can be interpreted as operating system commands, allowing for execution of arbitrary code with the privileges of the Zimbra user.
## Exploitation
- **Status:** Exploited in the wild (Reported by CERT Polska)
- **Complexity:** Low (Unauthenticated)
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Access to email communications and sensitive data)
- **Integrity:** High (Ability to execute OS commands and modify files)
- **Availability:** High (Potential for service disruption or system take-over)
## Remediation
### Patches
- **Zimbra Collaboration 10.1.20:** Users should upgrade to this version or later to resolve the flaw.
### Workarounds
- **Disable SNMP:** If the `zimbra-snmp` package is not essential, uninstalling it or disabling SNMP notifications can mitigate the risk.
- **Access Control:** Restrict SMTP traffic to trusted sources where possible, though this may not be feasible for general mail servers.
## Detection
CERT Polska recommends monitoring for the following indicators:
- **Log Analysis:** Check `/var/log/zimbra.log` for suspicious or unexpected Zimbra service restarts.
- **File Integrity:** Inspect the following directories for unauthorized files created within the last 30 days:
- `/opt/zimbra/jetty/webapps/`
- `/opt/zimbra/jetty_base/webapps/`
- `/tmp/`
## References
- **NVD Detail:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-73570
- **CERT Polska Advisory:** hxxps[://]moje[.]cert[.]pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/
- **Vendor Patch News:** hxxps[://]thehackernews[.]com/2026/07/zimbra-patches-critical-snmp-command[.]html