--- title: Critical Zimbra RCE flaw now actively exploited in attacks description: CERT Polska has confirmed active exploitation of CVE-2026-73570, a critical unauthenticated remote code execution flaw in Zimbra Collaboration Suite's SNMP... canonical: https://daily.dev/posts/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks-fz1s0ad13 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical Zimbra RCE flaw now actively exploited in attacks | daily.dev og:description: CERT Polska has confirmed active exploitation of CVE-2026-73570, a critical unauthenticated remote code execution flaw in Zimbra Collaboration Suite's SNMP... og:url: https://daily.dev/posts/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks-fz1s0ad13 og:image: https://api.daily.dev/og/posts/fz1s0AD13.png og:image:alt: Critical Zimbra RCE flaw now actively exploited in attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical Zimbra RCE flaw now actively exploited in attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary CERT Polska has confirmed active exploitation of CVE-2026-73570, a critical unauthenticated remote code execution flaw in Zimbra Collaboration Suite's SNMP monitoring component. The vulnerability allows attackers to send crafted SMTP requests that trigger arbitrary OS command execution as the zimbra user. Zimbra patched the issue in version 10.1.20 on July 20, but over 12,100 Zimbra servers remain exposed online, mostly in Europe and Asia. Admins are urged to check logs for suspicious service restarts and unexpected files in specific Zimbra directories. Zimbra has a history of being targeted by state-linked threat actors including Winter Vivern, APT29, and APT28. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-73570 in Zimbra Collaboration Suite and how is it exploited? CVE-2026-73570 is a critical unauthenticated remote code execution vulnerability in Zimbra Collaboration Suite's SNMP monitoring component. Due to improper sanitization of untrusted input during SNMP notification processing, attackers can send specially crafted SMTP requests to execute arbitrary operating system commands as the zimbra user, without needing valid credentials. _Teams running Zimbra can track fast-moving vulnerability disclosures like this one on daily.dev._ ### Which Zimbra version fixes the SNMP command injection RCE vulnerability? Zimbra 10.1.20, released on July 20, patches CVE-2026-73570, the SNMP-related command injection RCE flaw. CERT Polska has since reported active exploitation in the wild, and over 12,100 Zimbra servers remain exposed online globally, concentrated in Europe and Asia, meaning many instances likely remain unpatched. _Admins tracking urgent patch timelines for tools like Zimbra can follow updates on daily.dev._ ### How can I tell if my Zimbra server has been compromised via CVE-2026-73570? Check for signs such as the Zimbra service restarting on its own and unexpected files created by the zimbra user in the /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ directories within the last 30 days. These indicators were specifically flagged by CERT Polska in its warning about active exploitation of the vulnerability. _Security teams monitoring active exploitation campaigns like this one can stay current on daily.dev._ ## Similar posts on daily.dev - [Critical Zimbra security update fixes 9 vulnerabilities](https://daily.dev/posts/critical-zimbra-security-update-fixes-9-vulnerabilities-9ezatfhm8) · CSO Online · 0 upvotes · 0 comments - [Over 10,000 Zimbra servers vulnerable to ongoing XSS attacks](https://daily.dev/posts/over-10-000-zimbra-servers-vulnerable-to-ongoing-xss-attacks-f0dcy8pcn) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks-fz1s0ad13) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical Zimbra RCE flaw now actively exploited in attacks","url":"https://daily.dev/posts/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks-fz1s0ad13","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks-fz1s0ad13"},"datePublished":"2026-08-20T09:51:16.679Z","dateModified":"2026-08-25T12:11:23.393Z","description":"CERT Polska has confirmed active exploitation of CVE-2026-73570, a critical unauthenticated remote code execution flaw in Zimbra Collaboration Suite's SNMP...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5a0c7e8585132d295c25f886f6215893?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5a0c7e8585132d295c25f886f6215893?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks-fz1s0ad13","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Critical Zimbra RCE flaw now actively exploited in attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks-fz1s0ad13#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-73570 in Zimbra Collaboration Suite and how is it exploited?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-73570 is a critical unauthenticated remote code execution vulnerability in Zimbra Collaboration Suite's SNMP monitoring component. Due to improper sanitization of untrusted input during SNMP notification processing, attackers can send specially crafted SMTP requests to execute arbitrary operating system commands as the zimbra user, without needing valid credentials. Teams running Zimbra can track fast-moving vulnerability disclosures like this one on daily.dev."}},{"@type":"Question","name":"Which Zimbra version fixes the SNMP command injection RCE vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Zimbra 10.1.20, released on July 20, patches CVE-2026-73570, the SNMP-related command injection RCE flaw. CERT Polska has since reported active exploitation in the wild, and over 12,100 Zimbra servers remain exposed online globally, concentrated in Europe and Asia, meaning many instances likely remain unpatched. Admins tracking urgent patch timelines for tools like Zimbra can follow updates on daily.dev."}},{"@type":"Question","name":"How can I tell if my Zimbra server has been compromised via CVE-2026-73570?","acceptedAnswer":{"@type":"Answer","text":"Check for signs such as the Zimbra service restarting on its own and unexpected files created by the zimbra user in the /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ directories within the last 30 days. These indicators were specifically flagged by CERT Polska in its warning about active exploitation of the vulnerability. Security teams monitoring active exploitation campaigns like this one can stay current on daily.dev."}}]} ```