Zimbra RCE Vulnerability

Overview

CERT Polska has issued an urgent warning: attackers are actively exploiting a critical remote code execution (RCE) vulnerability in the Zimbra Collaboration Suite, tracked as CVE‑2026‑73570. This flaw allows unauthenticated attackers to execute arbitrary operating system commands as the zimbra user, making it a high‑risk threat for organizations running vulnerable mail servers.

Vulnerability Details

• CVE‑2026‑73570: OS command injection in Zimbra’s SNMP monitoring functionality.
• Affected configurations:
  • zimbra-snmp package installed.
  • SNMP notifications enabled via snmp_notify.
  • Swatchdog service running (enabled by default).
• Attack vector: Specially crafted SMTP requests exploit improper sanitization during SNMP notification processing.
• Impact: Arbitrary shell command execution with zimbra account privileges.

Exploitation Risks

Successful exploitation can enable attackers to:

• Deploy web shells for persistent access.
• Steal mailbox data and sensitive communications.
• Modify server configurations to weaken defenses.
• Establish persistence for long‑term control.
• Launch further intrusions into connected systems.

Detection Guidance

Administrators should:

• Inspect logs: Check /var/log/zimbra.log for suspicious service‑status messages (e.g., “stopped → running” or “running → stopped”).
• Review file changes: Investigate /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ for unexpected JSP files, scripts, or archives.
• Monitor SMTP activity: Look for unusual traffic patterns tied to SNMP notifications.

Mitigation Steps

• Upgrade immediately: Zimbra fixed the flaw in version 10.1.20 (released July 20, 2026).
• Disable SNMP notifications if patching is delayed.
• Isolate compromised hosts and preserve logs for forensic analysis.
• Rotate credentials and review mailbox access.
• Conduct full incident response if exploitation is suspected.

Expert in the Cloud Insight

This incident highlights the danger of default‑enabled services in enterprise software. With Swatchdog enabled by default, many organizations unknowingly expanded their attack surface. The lesson is clear: patch quickly, disable unnecessary services, and monitor aggressively. Mail servers are high‑value targets, and attackers will exploit even small misconfigurations to gain footholds.