Full Report
CERT Polska, the Polish Computer Emergency Response Team (CERT), warned that attackers have begun exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS). [...]
Analysis Summary
# Vulnerability: Unauthenticated OS Command Injection in Zimbra Collaboration Suite (ZCS)
## CVE Details
- **CVE ID:** CVE-2026-73570
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-78 (OS Command Injection)
## Affected Systems
- **Products:** Zimbra Collaboration Suite (ZCS)
- **Versions:** All versions prior to 10.1.20
- **Configurations:** Systems where **SNMP monitoring and SNMP notifications are enabled**.
## Vulnerability Description
The vulnerability exists due to improper sanitization of untrusted input during the processing of SNMP notifications. Specifically, the SNMP monitoring component fails to validate input received via SMTP requests. An unauthenticated attacker can send specially crafted SMTP traffic that triggers the execution of arbitrary operating system commands with the privileges of the 'zimbra' user.
## Exploitation
- **Status:** Actively exploited in the wild (Reported by CERT Polska).
- **Complexity:** Low
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** High (Full access to the 'zimbra' user data, including emails and credentials).
- **Integrity:** High (Ability to modify system files and web applications).
- **Availability:** High (Attacker can restart services or crash the server).
## Remediation
### Patches
- Upgrade to **Zimbra Collaboration Suite version 10.1.20** or later.
### Workarounds
- Disable SNMP notifications if they are not strictly required for your monitoring workflow.
- Restrict access to the Zimbra server to trusted IP addresses using a firewall or Security Groups to minimize exposure while patching.
## Detection
### Indicators of Compromise (IoC)
- Unexpected restarts of the Zimbra service.
- The presence of unauthorized or suspicious files created by the `zimbra` user in the following directories:
- `/opt/zimbra/jetty/webapps/`
- `/opt/zimbra/jetty_base/webapps/`
- `/tmp/`
### Detection Methods
- **Log Analysis:** Review system and application logs for unusual command executions or SMTP requests containing shell metacharacters (e.g., `;`, `&`, `|`, `` ` ``).
- **File Integrity Monitoring:** Monitor the webapp directories listed above for new or modified JSP files or shells.
## References
- **Zimbra Official Advisory:** hxxps[://]blog[.]zimbra[.]com/2026/07/patch-release-update-zimbra-10-1-20/
- **CERT Polska Warning:** hxxps[://]moje[.]cert[.]pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-73570