NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Zimbra SNMP command injection CVE-2026-73570 exploited; fixed in 10.1.20

Attackers are exploiting Zimbra email servers before 10.1.20 with optional SNMP monitoring enabled. Ask your email provider or IT team to update to 10.1.20 or later and investigate possible compromise, including stolen authentication secrets.

What to do

If your family, business or family office uses Zimbra email, ask the provider or IT team to confirm the servers run ZCS 10.1.20 or later. Ask them to investigate previously exposed servers for intruders and rotate Zimbra authentication secrets; updating your phone or email app does not update the server.

What’s happening

CVE-2026-73570 lets an attacker run operating-system commands as the Zimbra service account without signing in or requiring anyone to open an email. It affects Zimbra Collaboration before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Zimbra disclosed the underlying flaw on 26 June and released its permanent fix on 20 July. CISA confirmed exploitation on 21 August. Microsoft's September investigation documented persistent access, email access and authentication-secret collection across multiple organisations; completion of one mailbox-data transfer attempt remained unconfirmed. Zimbra describes the SNMP flaw as critical, while the CVE record assigns a high rating of 8.9. As at 3 November, the fix is available in 10.1.20 and later, but previously exposed servers also need investigation and authentication-secret rotation.

What
Flaw
Affects
Synacor Zimbra Collaboration Suite (ZCS) email servers
Affected
Zimbra Collaboration versions before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled
Fixed in
Zimbra Collaboration 10.1.20
CVE
CVE-2026-73570
Since
21 Aug 2026
Closed
30 Sept 2026

Timeline

  1. Wider attacks

    Microsoft documented compromises across multiple regions and industries, including persistent access and collection of email and authentication secrets. One investigated mailbox-data transfer attempt was not confirmed to have completed.

  2. Wider attacks

    BleepingComputer reported that Shadowserver had identified more than 270 compromised Zimbra instances while checking for exploitation artefacts.

  3. CISA added

    CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalogue, with a federal remediation deadline of 24 August. Its entry lists ransomware use as unknown.

  4. Made public

    The CVE-2026-73570 record was published. It identifies versions before 10.1.20 as affected when the optional zimbra-snmp package is installed and SNMP notifications are enabled.

  5. Update

    Microsoft later reported probes validating command execution between 28 July and 7 August, after the patch but before publication of the CVE.

  6. New fixFixed

    Zimbra released ZCS 10.1.20 with the permanent fix for command injection in SNMP monitoring when notifications are enabled.

  7. Made publicNo fix yet

    Zimbra disclosed the SNMP command-injection flaw in a security advisory, according to its subsequent patch announcement. A permanent fix was not yet available.

Sources

  1. Zimbra Security AdvisoriesZimbra
  2. Patch Release Update: Zimbra 10.1.20Zimbra · 20 July 2026
  3. Zimbra Daffodil (v10.1.20) Patch ReleaseZimbra · 20 July 2026
  4. CVE-2026-73570: CVE record and CISA exploitation entryCIRCL Vulnerability-Lookup · 13 Aug 2026
  5. CISA orders urgent patching of actively exploited Zimbra flawBleepingComputer · 24 Aug 2026
  6. Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570Microsoft · 30 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS