Critical Zimbra RCE Vulnerability CVE-2022-27925 Actively Exploited

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-73570, in Zimbra Collaboration Suite is currently being actively exploited.
• The flaw allows unauthenticated attackers to execute arbitrary commands as the Zimbra user on affected servers.
• The vulnerability targets the SNMP monitoring functionality when the zimbra-snmp package is installed, SNMP notifications are enabled, and the swatchdog service is running.
• Zimbra released a fix in version 10.1.20 on July 20, 2026, and immediate patching is strongly recommended.

Active Exploitation of Critical Zimbra RCE Vulnerability

Cybersecurity authorities, including CERT Polska, have issued a stern warning regarding the active exploitation of a severe remote code execution vulnerability present in the Zimbra Collaboration Suite. This critical flaw, identified as CVE-2026-73570, poses a significant risk to organizations utilizing the popular email and collaboration platform.

The vulnerability enables threat actors to execute arbitrary operating system commands with the privileges of the Zimbra user account on compromised servers. This can be achieved without requiring any prior authentication, making it a particularly dangerous entry point for attackers.

Technical Details of CVE-2026-73570

The core of CVE-2026-73570 lies within an OS command injection vulnerability found in Zimbra’s SNMP monitoring component. Systems are susceptible if they have the optional zimbra-snmp package installed, have SNMP notifications activated via the snmp_notify parameter, and are running the swatchdog service. Notably, the swatchdog service is typically enabled by default, which broadens the attack surface for organizations that have configured SNMP trap notifications.

Attackers can exploit this weakness by sending specially crafted SMTP requests. These requests are designed to bypass proper sanitization during the processing of SNMP notifications, thereby injecting malicious commands. The successful execution of these commands grants attackers shell access with the privileges of the Zimbra account.

Such unauthorized access could lead to a range of malicious activities, including the deployment of web shells, exfiltration of sensitive mailbox data, alteration of server configurations, establishment of persistent access, or leveraging the compromised mail server as a pivot point for broader network intrusions.

Patch Availability and Remediation

Zimbra has addressed CVE-2026-73570 in version 10.1.20 of the Collaboration Suite, which was released on July 20, 2026. The vendor’s security advisory confirms that this update specifically resolves the command injection issue within the SNMP monitoring component when notifications are active.

Given the confirmed active exploitation, organizations operating earlier versions of Zimbra Collaboration Suite should prioritize this patch with extreme urgency. CERT Polska has also published valuable detection guidance to assist defenders in identifying potential compromises.

Administrators are advised to scrutinize /var/log/zimbra.log for any suspicious service-status messages. Indicators of compromise may include unknown or malicious payloads changing status from stopped to running, or vice versa, which could signal an attacker’s attempt to manipulate processes via the vulnerable notification flow.

Furthermore, security teams should review files created by the Zimbra user within the last 30 days, paying particular attention to directories such as /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/. The presence of unexpected JSP files, executable scripts, archives, or recently altered application content in these locations could indicate payload staging or the establishment of persistence.

What You Should Do

• Identify and Inventory: Immediately identify all Zimbra Collaboration Suite servers within your environment.
• Verify Configuration: Confirm whether SNMP notifications are enabled on these servers.
• Apply Updates: Upgrade all vulnerable systems to Zimbra Collaboration Suite version 10.1.20 or a later fixed release without delay.
• Mitigation (if patching is not immediate): If immediate patching is not feasible, disable unnecessary SNMP notification functionality.
• Enhanced Monitoring: Implement rigorous monitoring of SMTP activity, Zimbra logs, process creation, and any file changes associated with the Zimbra user account.
• Incident Response: In the event of suspected exploitation, treat it as a potential mail server compromise. Preserve all relevant logs, isolate affected hosts as necessary, rotate credentials for all potentially impacted accounts, review mailbox access permissions, and initiate a full incident response investigation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.