Zimbra's Optional SNMP Package Turned Into an Unauthenticated RCE — and CERT Polska Caught It Exploited
CVE-2026-73570 sat patched for a month before anyone reported it being used. Then CISA added it to KEV with a 3-day deadline.
On July 20, 2026, Zimbra quietly shipped Collaboration Suite 10.1.20 with a fix for an unauthenticated remote code execution bug. For about a month, nothing happened publicly. Then, in the week of August 20, Poland's CERT Polska said it was seeing the flaw actively exploited — and gave defenders only file paths and log patterns to go on, no campaign details. CISA added it to the Known Exploited Vulnerabilities catalog the next day.
Scores as of 2026-08-22live record →
How an SNMP trap becomes a shell
CVE-2026-73570 (CWE-78, OS command injection) only exists on Zimbra Collaboration installs that have the optional zimbra-snmp package installed and SNMP trap notifications turned on via the snmp_notify parameter. Where that combination is present, Zimbra's watchdog service — the process that monitors and restarts Zimbra's own daemons, and which runs by default — processes SNMP notification input without properly sanitizing it. An unauthenticated attacker can send a specially crafted SMTP request that gets funneled into that notification path and comes out the other side as an arbitrary OS command, run as the zimbra user.
CVE-2026-73570 — from SMTP request to OS command
- Unauthenticated attacker — No login, no user interaction required
- Crafted SMTP request
- zimbra-snmp package installed?
- Not exploitable via this path
- snmp_notify enabled?
- Not exploitable via this path
- Watchdog service (default-on) parses notification input
- Unsanitized input reaches a shell call
- Arbitrary OS command runs as `zimbra` — Full mailbox access, persistence, lateral movement
The timeline: patched a month before anyone said it was being used
CVE-2026-73570 — from patch to KEV
- Zimbra ships the fix in 10.1.20No public exploitation reported at the time of release.
- CVE-2026-73570 record publishedFormal CVE assignment and NVD/CVE-list publication, roughly three weeks after the fix shipped.
- CERT Polska warns of active exploitationPoland's national CERT reports seeing attacks "this week" and publishes indicators — but not campaign details or attribution.
- CISA adds CVE-2026-73570 to the KEV catalogPer The Hacker News' updated reporting.
- FCEB remediation deadlineA 3-day window from KEV addition — short, consistent with confirmed active exploitation rather than a routine catch-up entry.
What CERT Polska actually gave defenders
No file hashes, no C2 IPs, no named threat actor — just behavioral indicators. If you run Zimbra with zimbra-snmp installed, this is the checklist:
- Check
/var/log/zimbra.logfor the Zimbra service unexpectedly stopping and restarting, or for status changes you didn't initiate. - Look for files created by the
zimbrauser in the last 30 days under/opt/zimbra/jetty/webapps/and/opt/zimbra/jetty_base/webapps/. - Check
/tmp/for unfamiliar files owned byzimbra— a common drop location once an attacker has command execution as that user. - If any of the above turn up something you can't explain, treat the host as compromised, not just unpatched — a config fix after the fact does not undo prior command execution.
Zimbra keeps making the KEV catalog — for very different reasons
| CVE | Weakness | CVSS | EPSS | Vector |
|---|---|---|---|---|
| CVE-2026-73570 | CWE-78 OS command injection | 8.9 | 1.0% | Unauthenticated SMTP request → SNMP notification handling |
| CVE-2025-66376 | CWE-79 stored XSS (Classic UI) | 7.2 | 22.0% | Malicious CSS @import in an HTML email, opened by a victim |
| CVE-2024-27443 | CWE-79 XSS (CalendarInvite) | 6.1 | 23.6% | Crafted calendar invite rendered in webmail |
None of the three EPSS scores track exploitation reality well. The two XSS bugs score higher on EPSS than the command-injection flaw that's currently being actively exploited — a reminder that EPSS predicts general exploitation likelihood across the whole CVE population, not whether a specific CVE has an active campaign against it right now. We've written about that gap before.
What to do
- Upgrade to Zimbra Collaboration 10.1.20 or later. This is the actual fix — nothing below replaces it.
- If you can't patch immediately, check whether
zimbra-snmpis installed andsnmp_notifyis enabled. If SNMP trap notifications aren't essential, disabling that configuration removes the specific trigger path (it does not fix the underlying code). - Run the CERT Polska log/file checks above regardless of patch status — if the box was already hit, patching alone won't evict an attacker who already has command execution.
- If you run Zimbra internet-facing, assume it's in the 12,100+ Shadowserver saw and prioritize accordingly.
Vulnerability data as of 2026-08-22