Critical Zimbra RCE Bug Actively Exploited, Patch Now

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-73570, in Zimbra Collaboration Suite is under active exploitation.
• The flaw allows unauthenticated attackers to execute arbitrary shell commands as the ‘zimbra’ user.
• Zimbra installations with the SNMP trap service enabled and the swatchdog service running are vulnerable.
• Zimbra has released a fix in version 10.1.20, and immediate patching is strongly advised.

Critical Zimbra RCE Bug Actively Exploited, Patch Now

Cybersecurity authorities are issuing urgent warnings regarding a critical operating system command-injection vulnerability within the Zimbra Collaboration Suite. Identified as CVE-2026-73570, this flaw is actively being exploited by threat actors, allowing unauthorized remote attackers to execute arbitrary shell commands with the privileges of the ‘zimbra’ user.

Understanding the Vulnerability

The vulnerability specifically impacts Zimbra deployments where the SNMP trap service is active through the snmp_notify parameter, and the swatchdog service is operational. Given that swatchdog is typically enabled by default, Zimbra servers exposed to the internet with configured SNMP notifications face a significantly elevated risk of compromise. Successful exploitation could grant attackers an initial foothold on vulnerable mail servers without requiring any valid authentication credentials.

Once inside, attackers can leverage this access to execute malicious commands, create or alter files, deploy web shells for persistent access, exfiltrate sensitive email data, establish long-term persistence, or pivot to other systems within the compromised organization’s network.

Active Exploitation and Remediation

CERT Polska has confirmed observing this issue in an ongoing exploitation campaign. Consequently, organizations utilizing Zimbra Collaboration Suite should prioritize this vulnerability as an immediate incident-response and patch-management imperative, rather than a routine software update.

Zimbra has addressed CVE-2026-73570 in version 10.1.20. Administrators are strongly advised to verify their current Zimbra version and upgrade all affected systems to this patched release as quickly as possible.

Mitigation for Unpatched Systems

For systems that cannot be immediately updated, security teams should assess whether the SNMP trap functionality is truly essential and if the snmp_notify configuration is currently enabled. Disabling these features where not critical can reduce exposure.

Furthermore, security personnel should meticulously review Zimbra logs for any suspicious alterations in service status. Log entries indicating an unfamiliar service or command payload transitioning between “stopped” and “running,” or vice-versa, could signal that an attacker has leveraged the vulnerable component to execute malicious commands via the swatchdog service.

Specifically, administrators should scrutinize /var/log/zimbra.log for unexpected “Service status change” records. Any service names, command strings, or payloads that deviate from normal operational patterns warrant immediate investigation. CERT Polska also recommends checking for recently created files owned by the ‘zimbra’ user, particularly in high-priority directories such as /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/.

Web application directories are of particular concern, as attackers frequently place JSP-based web shells or other malicious application files there to maintain remote access following initial exploitation. Any files created or modified within the last 30 days should be examined for unusual names, obfuscated code, unexpected archive files, executable scripts, unauthorized JSP files, and any associated outbound network activity from the Zimbra server.

Should indicators of compromise be discovered, organizations must isolate the affected server, preserve all logs and suspicious files for thorough forensic analysis, rotate any potentially exposed credentials, and investigate connected systems for signs of lateral movement. CERT Polska has requested that any evidence of suspected exploitation be reported to its incident-response team.

The active exploitation of CVE-2026-73570 underscores the persistent targeting of internet-facing email infrastructure. Proactive patching, diligent log review, and aggressive web-shell hunting are crucial measures to mitigate the risk of a complete Zimbra server compromise.

What You Should Do

• Immediately Patch: Upgrade all Zimbra Collaboration Suite installations to version 10.1.20 or newer without delay.
• Review Configurations: Assess if the SNMP trap functionality is necessary. If not, disable the snmp_notify configuration.
• Monitor Logs: Regularly inspect /var/log/zimbra.log for unusual “Service status change” records or suspicious command executions.
• Hunt for Web Shells: Check directories like /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ for recently created or modified files owned by the ‘zimbra’ user, especially looking for unauthorized JSP files or suspicious scripts.
• Incident Response: If compromise is suspected, isolate the server, preserve forensic evidence, rotate credentials, and investigate for lateral movement. Report findings to relevant cybersecurity authorities like CERT Polska.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.