Zimbra: One email is enough with SNMP

Zimbra servers with SNMP notifications enabled can be compromised without authentication through a crafted email. CERT Polska reports active exploitation. CISA added the vulnerability to its KEV catalog on 21 August.

Related: Cisco ASA: SSL-VPN DoS now in KEV  ·  Microsoft Teams: Android path lets attacker code through

What is the Zimbra SNMP vulnerability?

What is the Zimbra SNMP vulnerability? CVE-2026-73570 is a command injection vulnerability in Zimbra Collaboration before version 10.1.20. With the optional SNMP package installed and notifications enabled, an unchecked SMTP request can execute commands as user zimbra. CERT Polska reports active exploitation of this path. CISA added the same entry to its KEV catalog on 21 August.

CERT Polska reports exploitation

On 17 August 2026, CERT Polska reported active exploitation in advisory 145/2026. The vulnerability is CVE-2026-73570. Attackers need no account. They send an email that reaches the SNMP path, where it can execute as a command under user zimbra.

Four days later, on 21 August, CISA added the same entry to its Known Exploited Vulnerabilities Catalog. The alert names this exact CVE. It gives no count of compromised servers.

BleepingComputer quotes Shadowserver reporting over 12,000 internet-accessible Zimbra servers, around 4,400 in Europe. How many are patched or operating as honeypots remains unclear. The figure measures exposure rather than damage.

An email provides the entry point

The technical description is concise and reliable. Insufficient input sanitization in the SNMP notification path turns an SMTP request into an operating system command. The CVE entry identifies zimbra as the execution user. CERT Polska confirms this sequence.

The CVSS score is 8.9, rated high. The vector requires no privileges or user interaction. Attack complexity is high because several settings must align. That limits the scale without reducing the severity.

Three settings must align

Not every Zimbra server is automatically vulnerable. The CVE description specifies two conditions: the optional zimbra-snmp package and enabled SNMP notifications. CERT Polska additionally names the snmp_notify parameter and swatchdog service, which runs by default.

Servers without this combination fall outside the known attack path. Those running it on unpatched versions fall within it. Start by checking the package, parameter and service.

The patch has been available since July

Zimbra fixed command injection in SNMP monitoring on 20 July 2026 with version 10.1.20. The release notes and vendor blog describe the same fix. Four weeks separate the patch and CERT warning. That window is the real risk.

CERT Polska recommends checking the version and upgrading to the fixed release. Also check the log file and three directories: both Jetty webapps paths under /opt/zimbra and the temporary directory. Look for files created by account zimbra within the past four weeks.

If patching is not immediately possible, disabling SNMP notifications remains an effective temporary measure. It closes the known entry point. It replaces neither log checks nor subsequent upgrading.

No threat group or infection count

CERT Polska names no threat group or campaign scope. Attribution would be speculation. Earlier Zimbra campaigns from other years are not relevant to this case.

Shadowserver’s figure likewise measures exposure rather than infections. It counts accessible instances. The statistics do not reveal whether instances have the optional SNMP package.

Sources: CERT Polska 145/2026 of 17 August 2026; CVE-2026-73570; Zimbra Release 10.1.20 of 20 July 2026; CISA KEV alert of 21 August 2026; analysis from The Hacker News and BleepingComputer of 20 August 2026.

Frequently asked questions

Each question is collapsed. Tap to reveal the answer.

Which Zimbra instances are affected?

CVE-2026-73570 affects Zimbra Collaboration before patched version 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. CERT Polska additionally names the snmp_notify parameter and swatchdog service, which runs by default.

Is disabling SNMP notifications enough?

Temporarily, yes. Remediation remains incomplete. CERT Polska and Zimbra identify patching to 10.1.20 as the fix. Disabling SNMP alone closes the known path. Log and file checks remain necessary because exploitation is underway.

Which log entries should I check first?

CERT Polska points to /var/log/zimbra.log and Service status change lines containing unexpected payloads, where the status switches from stopped to running or vice versa. Also check files created by account zimbra in the Jetty webapps paths and /tmp.

Has CISA added the vulnerability to KEV?

Yes. The alert of 21 August 2026 lists CVE-2026-73570 as the sole addition to the Known Exploited Vulnerabilities Catalog.

Has a threat group been identified?

No. CERT Polska bulletin 145/2026 identifies neither a group nor campaign scope. Attribution would be speculation.

Editor’s Picks

▣Editor’s PickBOD 26-04: Prioritizing KEV and EPSS Correctly▣Editor’s PickN-central: Remote takeover possible without a patch▣Editor’s Pick622 CVEs: Prioritize Over Panic Patching

More from the MBF Media Network

▣cloudmagazinCloudflare: The Line Between Bot and Human Is Obsolete▣MyBusinessFutureBSI and TÜV: AI attacks hit one in six firms▣Digital ChiefsMicrosoft: Germany Is EU’s Top Cyberattack Target

Image source: AI-generated (August 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.