Zimbra SNMP Flaw CVE-2026-73570 Exploited: CISA Gave Agencies Three Days

CISA added CVE-2026-73570 to the Known Exploited Vulnerabilities catalog on August 21 and set the federal remediation deadline for August 24, a three-day window instead of the usual three weeks. That compressed timeline is the signal. When CISA shortens a BOD 22-01BOD 22-01🛡️CISA Binding Operational Directive 22-01, which requires U.S. Federal Civilian Executive Branch agencies to remediate vulnerabilities listed in the Known Exploited Vulnerabilities catalog by a set deadline. CISA shortens the deadline when exploitation is widespread. deadline, it means exploitation is already broad enough that the normal cadence would leave too many systems compromised before the clock runs out.

The vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. is an unauthenticated command injectionCommand Injection🛡️A security vulnerability that allows attackers to execute arbitrary operating system commands on the host system through a vulnerable application. in Zimbra Collaboration Suite (ZCS) versions before 10.1.20. It lives in the SNMP notification path, and it hands an attacker command execution as the zimbra user on the mail server itself. If you run Zimbra on-premises and the optional zimbra-snmp package is installed with notifications enabled, assume you are in scope until you have verified otherwise.

What Happened

Zimbra shipped the fix in ZCS 10.1.20 on July 20, 2026. For a month, nothing public suggested the bug was being weaponized. That changed on August 17, when CERT Polska published an advisory stating it had observed active exploitation against Polish organizations and released indicators of compromise (some secondary reporting dated the alert to August 19; the advisory itself is dated August 17). SecurityWeek and The Hacker News both place the observed attacks in the same week.

CISA responded within two days. The August 21 KEV entry describes the issue as an OS command injection in ZCS and requires Federal Civilian Executive Branch agencies to apply the update by August 24. Shadowserver, which scans the internet for exposed services, reported more than 12,100 Zimbra servers reachable online, with roughly 4,400 in Europe and 4,500 in Asia. By August 23 it had flagged more than 270 instances showing signs of compromise.

The threat actor has not been attributed. CERT Polska published indicators but withheld campaign specifics, and SecurityWeek notes that both the actor and its motivation remain unclear. That ambiguity is not comforting. Historically, Zimbra exploitation has come from two directions at once: state-aligned groups after diplomatic and military mail, and opportunistic criminals after credentials and mailbox access they can resell.

Who Is Affected

The affected population is narrower than "everyone running Zimbra," but not by as much as you would hope.

• ZCS versions prior to 10.1.20 are vulnerable in code.
• The optional zimbra-snmp package must be installed.
• SNMP notifications must be enabled.

Many administrators installed zimbra-snmp during initial deployment because it appears in the installer's package list and monitoring integration was on the build checklist. Whether it is actually feeding a monitoring system today is a separate question. Servers where the package was installed years ago and forgotten are exactly the ones nobody is watching for anomalous restarts.

Hosted Zimbra customers should confirm with their provider which version they are on and whether the SNMP component is present. Self-hosted deployments behind a reverse proxy are not protected by the proxy; the injection rides in over SMTP, which is the one port a mail server must expose.

Technical Analysis

The mechanics, as described by Zimbra's advisory and echoed across the sources, are straightforward. The SNMP notification component processes input that originates from untrusted SMTP traffic. That input is not sanitized before being passed into an operating system command. A crafted SMTP request therefore results in arbitrary command execution in the context of the zimbra user.

Three details matterMatter🏠A new universal smart home standard backed by Apple, Google, and Amazon for cross-platform compatibility. for your risk assessment.

First, this is pre-authentication. No account, no credentials, no user interaction. Anyone who can deliver mail to the server can attempt it, which is the entire internet.

Second, the zimbra user is not root, but on a mail server it does not need to be. That account owns the mail store, the LDAP configuration, the Jetty webapp directories, and the credentials the server uses to talk to its own components. Full mailbox access, credential harvesting, and persistence through a dropped web shellWeb Shell🛡️A malicious script placed in a web server's content directory that lets an attacker execute commands through HTTP requests. Web shells are a common persistence mechanism after remote code execution and are detected by looking for unexpected files in webapp directories. are all reachable without a second exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access.. Lateral movementLateral Movement🛡️Techniques attackers use to move through a network after initial compromise, seeking additional systems to control and data to steal. into the rest of the environment follows from harvested credentials, not from further privilege escalationPrivilege Escalation🛡️An attack technique where an adversary gains elevated access rights beyond what was initially granted. on the mail host.

Third, the CVSS score of 8.9 understates the operational severity for mail infrastructure. Scoring frameworks do not account for the fact that a compromised mail server is simultaneously a data source, a credential source, and a trusted sender for internal phishingPhishing🛡️A social engineering attack using fake emails or websites to steal login credentials or personal info..

The Hacker News notes this is not Zimbra's first appearance in the KEV this year. CVE-2025-66376, a stored cross-site scripting bug in the Classic UI, was weaponized as the ZimReaper payload attributed to the Russia-linked Laundry Bear group. SecurityWeek counts 18 Zimbra entries in the KEV catalog in total, four of them added in 2026. Zimbra is a recurring target because it is widely deployed by organizations that cannot or will not move to hosted mail, and those organizations frequently run it with minimal staffing.

Immediate Actions

Work through these in order. Patching first is correct, but patching alone is not a response if the server was exposed for a month of unknown exploitation.

1. Identify your version. Run zmcontrol -v as the zimbra user; per Zimbra's documentation it prints the release number, build number, platform, and build date. Anything below 10.1.20 is vulnerable.
2. Check whether zimbra-snmp is installed and whether notifications are enabled. If the package is not installed, you are not exposed to this CVE, but confirm rather than assume.
3. Upgrade to 10.1.20 or later. If you cannot upgrade immediately, disable SNMP notifications or remove the zimbra-snmp package as an interim mitigation, and document that as a temporary control with an owner and a date.
4. Hunt before you declare victory. CERT Polska's guidance is specific: review /var/log/zimbra.log for unexpected Zimbra service restarts, and look for files created within the last 30 days by the zimbra user under /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/. New files in the webapp directories are the signature of a dropped web shell.
5. If you find anything, treat the host as compromised. Rotate every credential the server holds or has seen, including LDAP bind passwords, admin accounts, and any service accounts that authenticate through it. Preserve logs before rebuilding.

A structured approach to the first 72 hours after a KEV addition helps here, because the deadline pressure tends to produce patchPatch🛡️A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program.-and-forget behavior. The patch closes the door; the hunt tells you whether anyone already walked through it.

Long-Term Outlook

The uncomfortable lesson is that the exposed component was optional. Every optional package installed on a network-facing server is a bet that its maintainers will never ship a bug in it. Reducing mail server attack surface by removing components that are not actively doing work is cheaper than any detection you will buy, and it would have taken this entire CVE off the table for a large fraction of the affected population.

The second lesson is about how command injection in network-facing services keeps recurring across products that have been patched for the same bug class before. The pattern is always the same: a protocol parser hands data to a shell. Understanding that pattern makes it easier to evaluate which of your other exposed services deserve the same scrutiny.

Expect follow-on activity. Once a pre-auth RCE against a widely deployed mail platform is known to be exploitable, exploitation broadens quickly from the original actor to everyone with a scanner. The 270 compromised instances Shadowserver counted on August 23 will not be the final number. If your Zimbra server sat unpatched and internet-facing between July 20 and the day you read this, the question is not whether to hunt but how thoroughly.

Sources

• BleepingComputer, "CISA orders urgent patching of actively exploitedActively Exploited🛡️A vulnerability that attackers are currently using in real-world attacks, requiring immediate patching regardless of severity score. Zimbra flaw" (August 24, 2026): https://www.bleepingcomputer.com/news/security/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw/
• The Hacker News, "Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution": https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html
• SecurityWeek, "Hackers Target Zimbra Servers in Active Exploitation Campaign": https://www.securityweek.com/hackers-target-zimbra-servers-in-active-exploitation-campaign/
• CISA KEVCISA KEV🛡️The Known Exploited Vulnerabilities catalog maintained by CISA, listing vulnerabilities actively exploited in attacks that federal agencies must patch by specific deadlines. alert, August 21, 2026: https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog
• CERT Polska advisory (primary source, August 17, 2026): https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/
• CISA Known Exploited Vulnerabilities catalog (JSON feed; dateAdded 2026-08-21, dueDate 2026-08-24): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• Zimbra documentation, zmcontrol: https://wiki.zimbra.com/wiki/Zmcontrol