Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
Summary: CERT Polska reported active exploitation of CVE-2026-73570, a command injection flaw (CVSS 8.9) in Zimbra Collaboration before 10.1.20 that lets an unauthenticated attacker send crafted SMTP requests to run operating system commands as the Zimbra user when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Zimbra patched the flaw in version 10.1.20 last month, CISA added it to the KEV catalog on August 21, 2026 with a fix deadline of August 24, 2026, and the Shadowserver Foundation counted 267 compromised Zimbra instances as of August 24, down from a high of 274, led by the U.S. with 46.
What you should know: 267 Zimbra instances were already compromised by the time the federal patch deadline arrived, and the flaw needs no credentials - only an exposed SNMP-enabled mail server. Zimbra has drawn repeated targeting, including a Russia-linked campaign tracked as Laundry Bear that used CVE-2025-66376 to plant the ZimReaper payload on Western government and commercial mail servers since at least July 2025.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-66376CVE-2026-73570
- Related
- CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability Known Exploited Vulnerabilities · Aug 21, 2026CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Known Exploited Vulnerabilities · Mar 18, 2026