Attackers Exploit Critical Zimbra SNMP Flaw for Unauthenticated RCE

A critical unauthenticated remote code execution (RCE) vulnerability in the Zimbra Collaboration Suite (ZCS) is being actively exploited in the wild. The flaw, tracked as CVE-2026-73570, allows remote attackers to execute arbitrary operating system commands on affected servers without requiring any prior credentials.

The vulnerability stems from improper input sanitization within the SNMP monitoring path of the suite, categorized as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). According to security reports, attackers can trigger the flaw by sending specially crafted SMTP requests. Once triggered, the system executes the injected commands with the privileges of the 'zimbra' user. The vulnerability has been assigned a CVSS score of 8.9, reflecting its high severity.

Technical Requirements

Not all ZCS installations are vulnerable. Exploitation requires a specific configuration: the optional `zimbra-snmp` package must be installed, and SNMP trap notifications must be enabled via the `snmp_notify` parameter. While the core suite is widely used for enterprise email and collaboration, this specific attack vector targets the Simple Network Management Protocol (SNMP) functionality typically used by administrators to monitor server health.

Industry Implications

This vulnerability is particularly dangerous because the 'zimbra' user possesses significant access to mail-related data, application directories, and critical configuration files. A successful exploit provides a foothold for attackers to engage in full mailbox theft, harvest credentials, or deploy web shells to maintain long-term persistence on the server. Furthermore, such access often serves as a jumping-off point for lateral movement deeper into a corporate network.

Current Status

CERT Polska has reported that the flaw is currently being exploited in the wild, elevating the risk from a theoretical vulnerability to an active threat. Administrators are urged to verify if the `zimbra-snmp` package is installed and whether SNMP notifications are active. While the attack vector relies on SMTP requests to trigger the SNMP flaw, the lack of authentication makes it a high-priority target for automated scanning and targeted attacks.