If you manage a Zimbra mail server, there’s a critical vulnerability being exploited in the wild. The issue relates to the Zimbra Collaboration Suite’s SNMP path and is tied to a flaw tracked as CVE-2026-73570.
Security researchers and CERT Polska have reported active exploitation against systems where the optional zimbra-snmp component is installed and SNMP notifications are enabled. The flaw is an OS command injection that can lead to remote code execution without authentication, running commands as the zimbra user. Zimbra released a patch in version 10.1.20 to address this issue.
What happened
In short: attackers are targeting Zimbra servers that have SNMP monitoring enabled. CVE-2026-73570 enables an unauthenticated attacker to execute arbitrary OS commands via the SNMP monitoring path. This creates a risk of mailbox compromise, persistence, and potential lateral movement within affected networks. The patch has been released as part of Zimbra’s security advisories, with the fix included in version 10.1.20.
Why it matters
Why this matters to you, whether you’re an admin at a small business, a creator running an email server, or someone who manages IT for a team:
- Direct impact on mail security: an attacker could gain control of the server and access mail data.
- Exposure risk increases with SNMP enabled: if SNMP is used and exposed to the internet or untrusted networks, the window for exploitation widens.
- Patch timing matters: not all deployments have updated to 10.1.20 or newer, leaving some systems vulnerable.
Practical steps you can take
- Check your Zimbra version: verify you’re on 10.1.20 or newer. Plan an upgrade if you’re on an older build and ensure you have working backups first.
- Disable SNMP if it’s not needed: if you don’t rely on zimbra-snmp, remove the package or disable SNMP monitoring to reduce attack surface.
- Secure SNMP if you must keep it: restrict SNMP access to trusted IPs, and avoid exposing SNMP notifications to public networks. Review snmp_notify configuration and related services.
- Apply the patch and verify: follow Zimbra’s security advisory, apply 10.1.20, and confirm all nodes are updated after maintenance windows.
- Audit and respond: check logs forunauthorized command executions, look for unfamiliar processes, and verify mailbox integrity and admin accounts.
- Harden the network: block inbound SNMP from the public internet, segment mail servers, and apply general hardening to the Zimbra deployment.
- Test backups: ensure you can restore mail data from backup and validate the restore process as part of your incident response plan.
Final thought
Keeping mail servers up to date is a simple, practical defense. If you run Zimbra, take a few minutes today to check your version, review SNMP usage, and apply the patch. Quick action can reduce risk and help keep email services safer for your users and collaborators.