# Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injection

> An unauthenticated remote code execution vulnerability (CVE-2026-73570, CVSS 8.9) in Zimbra Collaboration Suite (ZCS) prior to version 10.1.20 is being actively exploited in the wild. The OS command injection flaw resides in the optional zimbra-snmp package when SNMP notifications are enabled (with swatchdog running, enabled by default), allowing attackers to execute arbitrary OS commands as the zimbra user via crafted SMTP requests. CERT Polska confirmed a live exploitation campaign on August 17, 2026, with ENISA following suit on August 18.

- **Published:** 2026-08-20T00:00:00Z
- **Last reviewed:** 2026-10-20T08:59:56.587Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2082
- **ID:** TL-2026-2082
- **Severity:** CRITICAL (CVSS 8.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 75 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-73570

## Description

CVE-2026-73570 is a high-severity (CVSS 8.9) OS command injection vulnerability in Zimbra Collaboration Suite (ZCS) that enables unauthenticated remote code execution. The flaw exists in the optional zimbra-snmp package when SNMP trap notifications are enabled and the swatchdog service is running (swatchdog is enabled by default in Zimbra deployments). Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests to a vulnerable Zimbra server that, when processed through the SNMP notification subsystem, result in the execution of arbitrary operating system commands under the privileges of the zimbra user account. The vulnerability was fixed by Zimbra in version 10.1.20 ("Daffodil"), released on July 20, 2026, following a security advisory initially published on June 26, 2026.

CERT Polska issued advisory #145/2026 on August 17, 2026, warning that threat actors are actively exploiting CVE-2026-73570 in an ongoing campaign. ENISA confirmed exploitation in its KEV catalog on August 18, noting exploitation waves since the beginning of August. CERT-FR followed with advisory CERTFR-2026-AVI-1041 on August 19, and CCB Belgium issued an urgent warning the same day. Public reporting from SecurityWeek, BleepingComputer, and The Hacker News on August 20, 2026, brought the campaign to broader attention.

The Shadowserver Foundation tracked over 12,100 internet-exposed Zimbra servers, with the largest concentrations in Europe (4,382 servers) and Asia (4,492 servers), representing a substantial attack surface. The remaining servers were distributed across North America and other regions, though Shadowserver noted uncertainty about how many were honeypots or had already been patched.

Once attackers achieve command execution as the zimbra user, they can deploy web shells in Zimbra's Jetty web application directories (/opt/zimbra/jetty/webapps/ and /opt/zimbra/jetty_base/webapps/), drop staging files in /tmp/, access and exfiltrate email account data, harvest credentials from mailboxes and stored configurations, modify server-side settings, establish persistence mechanisms, and use the compromised mail server as a pivot point for lateral movement within the target network. The compromised Zimbra server runs email for the entire organization, making it a high-value target for credential theft, intelligence gathering, and further network penetration.

CERT Polska recommended specific IOC checks: inspect /var/log/zimbra.log for anomalous service status change entries containing attacker payloads, and audit files created by the zimbra user within the last 30 days under the Jetty webapps directories and /tmp/. No public proof-of-concept exploit code has been released, and no specific threat actor has been attributed to this campaign at the time of reporting. Zimbra vulnerabilities have historically been exploited by Russian state-sponsored groups (APT28, APT29, Winter Vivern, LAUNDRY BEAR) and Chinese state-sponsored actors, but the attribution for CVE-2026-73570 exploitation remains unknown.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1543 Create or Modify System Process
- T1078 Valid Accounts
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1021 Remote Services
- T1114 Email Collection
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1595 Active Scanning
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1595.002 Active Scanning
- T1588.005 Obtain Capabilities
- T1059.004 Command and Scripting Interpreter
- T1105 Ingress Tool Transfer
- T1505.003 Server Software Component
- T1036.005 Masquerading
- T1114.001 Email Collection
- T1046 Network Service Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1114.002 Email Collection
- T1071.001 Application Layer Protocol
- T1543.002 Create or Modify System Process
- T1053.003 Scheduled Task/Job
- T1548.003 Abuse Elevation Control Mechanism
- T1556.003 Modify Authentication Process
- T1070.006 Indicator Removal
- T1620 Reflective Code Loading
- T1021.004 Remote Services
- T1570 Lateral Tool Transfer
- T1560.001 Archive Collected Data
- T1567.002 Exfiltration Over Web Service
- T1496 Resource Hijacking

## Sources

- [CERT Polska Advisory #145/2026 — Aktywnie wykorzystywana podatnosc w Zimbra Collaboration Suite](https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/)
- [ENISA KEV — CVE-2026-73570](https://db.gcve.eu/vuln/cve-2026-73570)
- [CERT-FR Advisory CERTFR-2026-AVI-1041](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1041/)
- [SecurityWeek — Hackers Target Zimbra Servers in Active Exploitation Campaign](https://www.securityweek.com/hackers-target-zimbra-servers-in-active-exploitation-campaign/)
- [BleepingComputer — Critical Zimbra RCE flaw now actively exploited in attacks](https://www.bleepingcomputer.com/news/security/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks/)
- [The Hacker News — Attackers Exploit Zimbra SNMP Flaw for Unauthenticated RCE](https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html)
- [CybersecurityNews — Zimbra RCE Vulnerability Actively Exploited in the Wild](https://cybersecuritynews.com/zimbra-rce-vulnerability-exploited/)
- [SecurityOnline — Zimbra CVE-2026-73570 RCE Exploited in the Wild](https://securityonline.info/zimbra-cve-2026-73570/)
- [NVD — CVE-2026-73570 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-73570)
- [GitHub Advisory — GHSA-jqh7-pchh-v74j](https://github.com/advisories/GHSA-jqh7-pchh-v74j)
- [Zimbra Releases — 10.1.20 (Daffodil) Patch Release](https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.20)
- [Zimbra Security Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)
- [Zimbra Blog — Patch Release Update Zimbra 10.1.20](https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/)
- [CSO Online — Critical Zimbra security update fixes 9 vulnerabilities](https://www.csoonline.com/article/4200221/critical-zimbra-security-update-fixes-9-vulnerabilities.html)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2082