Full Report
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies to patch an actively exploited vulnerability in Zimbra Collaboration Suite (ZCS) within three days. [...]
Analysis Summary
# Vulnerability: Unauthenticated RCE in Zimbra Collaboration Suite SNMP Component
## CVE Details
- **CVE ID:** CVE-2026-73570
- **CVSS Score:** Not explicitly listed in text (Severity: Critical based on RCE and CISA KEV status)
- **CWE:** CWE-77 (Improper Neutralization of Special Elements used in a Command / Command Injection)
## Affected Systems
- **Products:** Zimbra Collaboration Suite (ZCS)
- **Versions:** Versions prior to 10.1.20
- **Configurations:** Systems where **SNMP monitoring/notifications** are enabled.
## Vulnerability Description
The flaw resides in the SNMP monitoring component of Zimbra Collaboration Suite. It is caused by improper sanitization of untrusted input during the processing of SNMP notifications. An unauthenticated attacker can trigger the vulnerability by sending specially crafted SMTP requests. This leads to a command injection that allows the execution of arbitrary operating system commands with the privileges of the `zimbra` user.
## Exploitation
- **Status:** **Exploited in the wild**. Added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on August 21, 2026.
- **Complexity:** Low (Targeted via specially crafted SMTP requests)
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full access to email data and system files)
- **Integrity:** High (Ability to modify files and system configurations)
- **Availability:** High (Potential for service disruption or full system takeover)
## Remediation
### Patches
- **ZCS 10.1.20:** Released July 20, 2026. All administrators are urged to update to this version or later immediately.
### Workarounds
- **Disable SNMP:** If patching is not immediately possible, disabling the SNMP monitoring component may mitigate the specific attack vector, though official vendor patching is the only recommended long-term solution.
## Detection
- **Log Analysis:** Monitor for unexpected restarts of the Zimbra service.
- **File System Monitoring:** Inspect the following directories for suspicious files created by the `zimbra` user within the last 30 days:
- `/opt/zimbra/jetty/webapps/`
- `/opt/zimbra/jetty_base/webapps/`
- `/tmp/`
- **Internet Presence:** Use tools like Shadowserver to identify if organizational ZCS instances are exposed to the public internet.
## References
- **Vendor Advisory:** hxxps[://]blog[.]zimbra[.]com/2026/07/patch-release-update-zimbra-10-1-20/
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-73570
- **CERT Polska Alert:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks/