A Critical Zimbra Vulnerability Is Already Being Exploited in Attacks

CERT Polska, Poland's cyber incident response team, has reported that attackers have begun exploiting a critical vulnerability in the Zimbra Collaboration Suite (ZCS) mail and collaboration package. The product is used by hundreds of millions of people and organizations around the world, including thousands of companies and hundreds of government agencies.

What the vulnerability is about

The flaw has been assigned the identifier CVE-2026-73570 and is tied to the SNMP monitoring component. Because untrusted input is improperly sanitized when SNMP notifications are processed, an unauthenticated attacker can send specially crafted SMTP requests that lead to the execution of arbitrary operating-system commands as the zimbra user. The precondition for it to trigger is that SNMP notifications are enabled.

A fix was released back on July 20 in version 10.1.20. On Monday, CERT Polska recorded that the vulnerability is already being used in real-world attacks and urged administrators to check their logs for suspicious activity: spontaneous restarts of the Zimbra service, as well as files created by the zimbra user over the past 30 days in the /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/ and /tmp/ directories.

The scale of the threat

According to the Shadowserver monitoring service, more than 12,100 Zimbra servers are exposed on the internet, most of them in Europe (4,382) and Asia (4,492). It is not known, however, how many of these are honeypot traps or have already been updated.

Zimbra has long remained an attractive target. In February 2023, the Winter Vivern group used a reflected XSS vulnerability to steal emails from organizations connected to NATO. In October 2024, U.S. and U.K. cyber agencies warned that APT29 (also known as Midnight Blizzard and Cozy Bear, and linked to Russia's Foreign Intelligence Service) was hunting Zimbra servers. And in March, researchers at Seqrite Labs reported the exploitation of a stored XSS vulnerability by the APT28 group, which is linked to Russian military intelligence — the targets were the ZCS servers of Ukrainian government agencies.

Administrators of vulnerable servers are advised to install the patched version as soon as possible and to check their systems for signs of compromise.

Source: Bleeping Computer