Zimbra SNMP RCE Now Exploited in the Wild

Active exploitation confirmed. Poland’s CERT Polska is tracking attacks against Zimbra Collaboration Suite servers targeting CVE-2026-73570 — a CVSS 8.9 unauthenticated command injection in the SNMP handler that enables remote code execution on the mail server host. SecurityWeek and The Hacker News both confirmed the active campaign on August 20, 2026.

What’s affected

Zimbra Collaboration (ZCS) installations prior to version 10.1.20. The vulnerable component is the SNMP handler. The flaw is command injection, unauthenticated on affected configurations — no credentials required.

CVSS: 8.9 (High). Vendor: Synacor.

Patch status

A fix shipped with Zimbra 10.1.20, released July 2026 — covered in our 10.1.20 release analysis. That release patched nine issues; this SNMP injection was the most severe. Active exploitation is now confirmed. The window between patch availability and enterprise patch deployment is what attackers are using.

Immediate response

1. Patch to Zimbra 10.1.20 or later.
2. If patching cannot happen immediately: firewall SNMP ports (161/UDP, 162/UDP) to trusted management hosts only.
3. Review mail server logs for anomalous activity originating from the SNMP service and any signs of lateral movement from the ZCS host.
4. Consult CERT Polska’s advisory for current indicators of compromise.

Attribution: unconfirmed. Campaign scale: not yet published. Any ZCS instance below 10.1.20 with SNMP reachable from an untrusted network segment should be treated as a priority patch target.

Prior context

Zimbra is a recurring high-value target. Void Blizzard exploited a separate Zimbra flaw for zero-click email theft in July. SNMP command injection was flagged as the top risk in the 10.1.20 release notes — the gap between “patch is available” and “fleet is updated” is where this campaign lives.