CVE-2026-73570: Zimbra Mail Server Exploitation

Introduction

Microsoft has disclosed active exploitation of CVE-2026-73570, a critical unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. For organizations running internet-facing Zimbra servers, this matters because attackers can trigger code execution through a specially crafted email, with no authentication or user interaction required.

What’s new

Vulnerability details

• CVE-2026-73570 affects the Zimbra SNMP notification path.
• Exploitation is possible when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
• Attackers can send a crafted SMTP request that injects shell commands into SNMP processing.
• Successful exploitation runs commands with the privileges of the zimbra service account.

Observed attacker activity

Microsoft observed real-world attacks that included:

• Deployment of JSP web shells in public application directories
• Use of reverse shells and remote payload downloads via curl or wget
• Privilege escalation to gain broader control of the host
• Persistent access through system services and recurring execution methods
• Mailbox and authentication data collection
• Archive creation and data exfiltration from compromised mail servers

Timeline

• July 20, 2026: Zimbra version 10.1.20 released with the relevant remediation
• July 28 to August 7, 2026: Microsoft observed pre-disclosure scanning and probing
• August 13, 2026: Public disclosure of CVE-2026-73570

Why this matters for IT administrators

This is not a theoretical issue. Microsoft telemetry shows attackers used both automated exploitation and hands-on-keyboard activity after compromise. Because the vulnerability can be exploited remotely against exposed mail servers, affected organizations may face rapid compromise, persistence, and access to sensitive mailbox data.

Admins should also note that exploitation was observed across multiple regions and industries, so risk is not limited to a specific sector.

Recommended actions

• Update Zimbra immediately to version 10.1.20 or later.
• Verify whether zimbra-snmp is installed and whether SNMP notifications are enabled.
• Review internet-facing Zimbra servers for signs of compromise, including:
  • Unexpected JSP files or web shells
  • Suspicious curl, wget, ping, or nslookup activity
  • Unauthorized systemd services or cron jobs
  • Changes to PAM, sudoers, or file permissions
• Investigate mailbox access, archive creation, and unusual outbound transfers.
• Isolate and remediate compromised servers if indicators are found.

Bottom line

Organizations running exposed Zimbra infrastructure should treat CVE-2026-73570 as a high-priority incident response and patching issue. If the vulnerable configuration exists, immediate remediation and threat hunting are strongly advised.