Warning: Actively Exploited Remote Code Execution in Zimbra Collaboration , Patch Immediately!

Ccb.Belgium.Be • August 19, 2026

CVE/CVSS: CVE-2026-73570: CVSS 8.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Vendor -

CVE-2026-73570 is a remote code execution vulnerability affecting Zimbra Collaboration. Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary shell commands with the privileges of the zimbra user. The vulnerability poses a significant risk to the confidentiality, integrity, and availability (CIA) of affected Zimbra Collaboration systems.

Security researchers have identified an ongoing campaign that is actively exploiting this vulnerability.

CVE-2026-73570 is a high-severity (CVSS score of 8.9) remote code execution vulnerability affecting Zimbra Collaboration versions prior to 10.1.20.

This vulnerability results from improper sanitization of untrusted input within Zimbra Collaboration’s SNMP notification processing. When the optional zimbra-snmp package is installed and SNMP notifications are enabled, an unauthenticated attacker may submit specially crafted SMTP requests, potentially resulting in the injection of malicious data into operating system commands and arbitrary command execution with Zimbra user privileges.

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.

The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion. In case of an intrusion, you can report an incident via . While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Zimbra Exploited by Attackers A critical remote code execution vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite is being actively exploited by attackers. The flaw, which affects versions prior to 10.1.20, allows unauthenticated attackers to execute arbitrary commands as the Zimbra user through improper input sanitization in SNMP notification processing. CERT Polska reported that over 12,100 Zimbra servers are exposed online, primarily in Europe and Asia. Security teams are urged to check logs for suspicious activity and to patch systems immediately. The vulnerability has a CVSS score of 8.9, indicating high severity. Previous Zimbra vulnerabilities have been exploited by state-sponsored groups, raising concerns about the potential for significant breaches. Organizations are advised to enhance monitoring and detection capabilities to mitigate risks. 23 sources 79

Extracted Entities

Warning: Actively Exploited Remote Code Execution in Zimbra Collaboration , Patch Immediately!

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)