{"id":"zimbra-snmp-command-injection-aug-2026","category":"patch","status":"closed","title":"Zimbra SNMP command injection CVE-2026-73570 exploited; fixed in 10.1.20","tldr":"Attackers are exploiting Zimbra email servers before 10.1.20 with optional SNMP monitoring enabled. Ask your email provider or IT team to update to 10.1.20 or later and investigate possible compromise, including stolen authentication secrets.","summary":"CVE-2026-73570 lets an attacker run operating-system commands as the Zimbra service account without signing in or requiring anyone to open an email. It affects Zimbra Collaboration before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Zimbra disclosed the underlying flaw on 26 June and released its permanent fix on 20 July. CISA confirmed exploitation on 21 August. Microsoft's September investigation documented persistent access, email access and authentication-secret collection across multiple organisations; completion of one mailbox-data transfer attempt remained unconfirmed. Zimbra describes the SNMP flaw as critical, while the CVE record assigns a high rating of 8.9. As at 3 November, the fix is available in 10.1.20 and later, but previously exposed servers also need investigation and authentication-secret rotation.","action":"If your family, business or family office uses Zimbra email, ask the provider or IT team to confirm the servers run ZCS 10.1.20 or later. Ask them to investigate previously exposed servers for intruders and rotate Zimbra authentication secrets; updating your phone or email app does not update the server.","product":"Synacor Zimbra Collaboration Suite (ZCS) email servers","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-73570"],"tags":["synacor","zimbra","email","command-injection","remote-code-execution","actively-exploited"],"affected":["Zimbra Collaboration versions before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled"],"fixed":["Zimbra Collaboration 10.1.20"],"matches":[],"sources":[{"kind":"advisory","title":"Zimbra Security Advisories","url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","by":"Zimbra","date":""},{"kind":"post","title":"Patch Release Update: Zimbra 10.1.20","url":"https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/","by":"Zimbra","date":"2026-07-20"},{"kind":"advisory","title":"Zimbra Daffodil (v10.1.20) Patch Release","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.20","by":"Zimbra","date":"2026-07-20"},{"kind":"advisory","title":"CVE-2026-73570: CVE record and CISA exploitation entry","url":"https://cve.circl.lu/vuln/cve-2026-73570","by":"CIRCL Vulnerability-Lookup","date":"2026-08-13"},{"kind":"news","title":"CISA orders urgent patching of actively exploited Zimbra flaw","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw/","by":"BleepingComputer","date":"2026-08-24"},{"kind":"research","title":"Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570","url":"https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/","by":"Microsoft","date":"2026-09-30"}],"started":"2026-08-21","closed":"2026-09-30","created":"2026-11-03T22:13:31.581Z","updated":"2026-11-03T22:13:31.581Z","cve_notes":[{"cve":"CVE-2026-73570","name":"Command injection in Zimbra SNMP notifications","what":"Unsafe input handling in Zimbra's SNMP notification component lets an unauthenticated attacker send crafted email-server requests that run operating-system commands as the Zimbra service account when the optional SNMP package and notifications are enabled.","severity":"critical","cvss":8.9}],"timeline":[{"at":"2026-09-30","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Microsoft documented compromises across multiple regions and industries, including persistent access and collection of email and authentication secrets. One investigated mailbox-data transfer attempt was not confirmed to have completed.","url":"https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/","by":"Microsoft","patch":null},{"at":"2026-08-24","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"BleepingComputer reported that Shadowserver had identified more than 270 compromised Zimbra instances while checking for exploitation artefacts.","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw/","by":"BleepingComputer","patch":null},{"at":"2026-08-21","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalogue, with a federal remediation deadline of 24 August. Its entry lists ransomware use as unknown.","url":"https://cve.circl.lu/vuln/cve-2026-73570","by":"CIRCL Vulnerability-Lookup, reproducing CISA's entry","patch":null},{"at":"2026-08-13","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"The CVE-2026-73570 record was published. It identifies versions before 10.1.20 as affected when the optional zimbra-snmp package is installed and SNMP notifications are enabled.","url":"https://cve.circl.lu/vuln/cve-2026-73570","by":"CIRCL Vulnerability-Lookup","patch":null},{"at":"2026-07-28","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Microsoft later reported probes validating command execution between 28 July and 7 August, after the patch but before publication of the CVE.","url":"https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/","by":"Microsoft","patch":null},{"at":"2026-07-20","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Zimbra released ZCS 10.1.20 with the permanent fix for command injection in SNMP monitoring when notifications are enabled.","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.20","by":"Zimbra","patch":"patched"},{"at":"2026-06-26","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Zimbra disclosed the SNMP command-injection flaw in a security advisory, according to its subsequent patch announcement. A permanent fix was not yet available.","url":"https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/","by":"Zimbra","patch":"none"}],"url":"https://hard.fyi/live/zimbra-snmp-command-injection-aug-2026/","json":"https://hard.fyi/api/live?id=zimbra-snmp-command-injection-aug-2026"}