Zimbra SNMP Flaw CVE-2026-73570 Actively Exploited for Unauthenticated RCE

A now-patched command injection vulnerability in Zimbra Collaboration (ZCS), tracked as CVE-2026-73570 (CVSS 8.9), is under active exploitation in the wild, according to CERT Polska. The flaw allows unauthenticated attackers to achieve remote code execution by sending specially crafted SMTP requests when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Zimbra patched the issue in version 10.1.20. CERT Polska advises administrators to check /var/log/zimbra.log for suspicious service restarts and to inspect web directories for recently created files. This comes amid ongoing threat actor interest in Zimbra, including a Russia-linked campaign by Laundry Bear exploiting CVE-2025-66376 to deliver the ZimReaper JavaScript payload.