Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

# Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

A critical remote code execution vulnerability in Zimbra Collaboration Suite (ZCS) is now under active exploitation by threat actors in the wild. Poland's Computer Emergency Response Team (CERT Polska) disclosed the attack campaign, confirming that CVE-2026-73570 poses an immediate threat to organizations running vulnerable versions of the email and collaboration platform.

The vulnerability carries a CVSS severity score of 8.9, placing it in the critical range. The flaw stems from a command injection weakness that permits unauthenticated attackers to execute arbitrary code on affected Zimbra servers remotely. This means an attacker requires no valid credentials to compromise a system, significantly broadening the attack surface for any organization exposing a vulnerable Zimbra instance to the internet.

Zimbra Collaboration Suite serves tens of thousands of organizations globally, from small businesses to large enterprises and government agencies. The platform handles email, calendar, contacts, and team collaboration functions, making it a high-value target. A successful exploit grants attackers full control over the messaging infrastructure, enabling them to steal emails, harvest credentials, implant backdoors, or pivot deeper into internal networks.

The command injection flaw exists within Zimbra's SNMP (Simple Network Management Protocol) functionality. SNMP typically runs on port 161 and historically represents a blind spot for defenders. Attackers can craft malicious SNMP requests that break out of intended command boundaries and execute shell commands with the privileges of the Zimbra process. This execution path bypasses Zimbra's normal authentication mechanisms entirely.

CERT Polska's disclosure confirms threat actors have already weaponized the flaw. The active exploitation suggests attackers are targeting visible Zimbra instances, likely through automated scanning and payload delivery. Organizations that have not yet patched face immediate compromise risk.

Zimbra released patches closing CVE-2026-73570, though the exact timeline between public disclosure and patch availability remains unclear from available reporting. Organizations running Zimbra must prioritize applying the security update across all affected infrastructure. This includes both on-premises deployments and hosted instances where they retain administrative responsibility.

The exploitation demonstrates a pattern recurring across enterprise collaboration platforms. Exchange Server (ProxyLogon vulnerabilities), Atlassian Confluence (CVE-2023-22515), and Ivanti Connect Secure have all suffered similar mass-exploitation events. Threat actors recognize that compromising email and collaboration hubs yields immediate access to sensitive communications and credentials at scale.

For organizations running Zimbra, immediate actions include checking patch status, deploying updates without delay, reviewing email logs for indicators of compromise, and scanning for web shells or persistence mechanisms attackers may have installed. Disabling SNMP access from untrusted networks provides a temporary mitigation if patching cannot be completed immediately.

Security teams should assume that any Zimbra instance exposed to the internet prior to patching may have been compromised. Full forensic investigation of affected servers is prudent, including memory analysis and log retention examination from the exploitation window.