Critical Remote Code Execution Vulnerability in Zimbra Collaboration Exploited

A remote code execution vulnerability, CVE-2026-73570, has been identified in Zimbra Collaboration versions prior to 10.1.20. This vulnerability arises from improper sanitization of untrusted input during SNMP notification processing, allowing unauthenticated attackers to execute arbitrary commands as the Zimbra user. Security researchers have reported ongoing exploitation of this vulnerability, which poses significant risks to the confidentiality, integrity, and availability of affected systems. The Centre for Cybersecurity Belgium has issued an urgent advisory recommending immediate patching of vulnerable installations. Organizations are also advised to enhance monitoring and detection capabilities to identify suspicious activities. The vulnerability has a CVSS score of 8.9, indicating a high severity level. Affected systems include those with the optional zimbra-snmp package installed and SNMP notifications enabled. Patching is essential to mitigate risks associated with this vulnerability.

Key Points: • CVE-2026-73570 is a high-severity remote code execution vulnerability in Zimbra. • Exploitation allows unauthenticated attackers to execute arbitrary commands as the Zimbra user. • Immediate patching is recommended due to ongoing exploitation campaigns.