Act nowKnown exploited

Advisory · CVE-2026-73570

Zimbra's SNMP handler lets strangers run shell commands

An unauthenticated attacker can send specially crafted SMTP requests to Zimbra Collaboration Suite and trigger OS command injection through SNMP notification processing when the zimbra-snmp package is installed.

Advisory published August 21, 2026Independent summary
Vendor
Synacor
Product
Zimbra Collaboration Suite
Identifier / CWE
CVE-2026-73570
CWE-78
Action timing
Sep 11, 2026
ELI5

Explain it like I’m five

Zimbra's mailman is supposed to shout arrival notices through a megaphone, but he repeats the sender's words without checking them first. A letter written in a special code makes him shout orders that the building then obeys.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted SMTP request

    An unauthenticated attacker sends specially crafted SMTP requests to the Zimbra server.

  2. 02SNMP notification triggered

    On systems with the optional zimbra-snmp package installed and SNMP notifications enabled, the requests pass through SNMP notification processing.

  3. 03Unsanitized input

    Untrusted input is not properly sanitized before being used by the notification handler.

  4. 04Command execution

    The attacker achieves execution of arbitrary operating system commands as the zimbra user.

What happened

On August 21, 2026, CISA added CVE-2026-73570 to the Known Exploited Vulnerabilities catalog, citing active exploitation of an OS command injection flaw in Zimbra Collaboration Suite (ZCS). It is rated high at CVSS 8.9.

The vulnerability affects ZCS before 10.1.20 on installations where the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that result in execution of arbitrary operating system commands as the zimbra user. SMTP is exposed by definition on a mail server, so the attack surface is wherever the server accepts mail.

Zimbra’s own security center documents the fixed release as ZCS 10.1.20. Because the flaw sits in an optional component, the fastest scoping question is whether zimbra-snmp is installed and whether SNMP notifications are actually in use in your deployment.

What to do

  1. Upgrade affected ZCS deployments to 10.1.20 or later.
  2. Determine whether the optional zimbra-snmp package is installed and whether SNMP notifications are enabled; if they are not needed, disabling them or removing the package is a fast interim exposure reduction.
  3. Review mail and system logs for unusual SMTP requests and unexpected child processes spawned by the zimbra user, especially around the dates the server was internet-exposed.
  4. If exploitation is suspected, treat the host as compromised: rebuild from known-good media, rotate credentials and secrets stored on the server, and review mailbox and administrative activity for follow-on access.
  5. Confirm the running ZCS version and that SNMP settings match your intended configuration after remediation.

Management note

Mail servers are permanently internet-facing by design, and this one converts an anonymous email into shell access whenever an optional monitoring feature is switched on. The fix is a version upgrade, but the scoping step is just as important: many Zimbra deployments carry the vulnerable package without ever using it. Find out if you are exposed before you assume you are not.