Zimbra Warns CVE-2026-73570 RCE Is Under Active Attack, Threatening 10.1.20-Before Servers
Updated
Updated · The Hacker News · Aug 20
Zimbra Warns CVE-2026-73570 RCE Is Under Active Attack, Threatening 10.1.20-Before Servers
3 articles · Updated · The Hacker News · Aug 20
Summary
CERT Polska said attackers are actively exploiting CVE-2026-73570, a Zimbra Collaboration command-injection flaw that can trigger remote code execution on unpatched servers.
The bug affects ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled, letting unauthenticated attackers send crafted SMTP requests to run OS commands as the Zimbra user.
Zimbra patched the issue last month in version 10.1.20, and CERT Polska urged administrators to inspect /var/log/zimbra.log for suspicious service restarts and recent files in webapps and /tmp directories.
Zimbra servers remain a frequent target: the U.S. last month tied a separate campaign since July 2025 to Russia-linked Laundry Bear, which used CVE-2025-66376 and the ZimReaper payload to steal emails and other data.