Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
- ID
- 16092
- Status
- summarized
- Published
- 20 Aug 2026, 9:24 PM
- Fetched
- 20 Aug 2026, 11:45 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.0
- Created
- 20 Aug 2026, 11:48 PM
- Tags
- Audience
- developers
What happened
A patched Zimbra Collaboration (ZCS) flaw, CVE-2026-73570 (CVSS 8.9), is under active exploitation per CERT Polska. The command injection vulnerability allows unauthenticated remote code execution when the optional zimbra-snmp package is installed and SNMP notifications are enabled, affecting versions before 10.1.20.
Why it matters
If you run Zimbra Collaboration with the zimbra-snmp package enabled, patch to 10.1.20 immediately and check /var/log/zimbra.log for suspicious service restarts and files in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ from the last 30 days. For most of the audience not running Zimbra, this has no direct action.
Discussion angle
Whether your org or clients run self-hosted email stacks like Zimbra, and the recurring pattern of Zimbra CVEs being weaponized by state-linked actors.