Zimbra has patched a critical vulnerability that CERT Polska says attackers are already exploiting in the wild. Tracked as CVE-2026-73570 and rated 8.9 out of 10 on the CVSS scale, the flaw sits in Zimbra Collaboration Suite's SNMP monitoring component: when SNMP notifications are switched on, the server fails to properly sanitise data it processes from incoming SMTP traffic, letting an attacker slip in a specially crafted request that runs as an operating-system command under the Zimbra service account. No login or valid mailbox is required — an internet-facing Zimbra server with SNMP notifications enabled is enough.
Zimbra shipped the fix in version 10.1.20 last month, but CERT Polska's warning this week confirms real attacks are now targeting servers that haven't updated. Signs of compromise include unexpected Zimbra service restarts and new files appearing under /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/ or /tmp — worth checking logs for the past 30 days even if you believe you're already patched. Researchers tracking internet-exposed Zimbra installs via Shadowserver still count more than 12,000 servers reachable from the open internet.
What this means for your business
- If your organisation self-hosts Zimbra Collaboration Suite — or a hosting provider or MSP runs it on your behalf — confirm this week that the server is on version 10.1.20 or later. Ask the question directly rather than assuming it was included in routine maintenance.
- If an immediate upgrade isn't possible, check whether SNMP notifications are enabled and turn them off if you don't rely on them. That single setting closes this specific attack path without needing the upgrade window.
- Search your mail server logs for the indicators above: unplanned service restarts and unexpected files in those directories. If you find either, treat it as a likely compromise and bring in someone to investigate properly rather than just deleting the files.
- Because the attacker gets code execution as the mail server's own service account, a successful exploit can expose every mailbox the server hosts — plan the response around that scale, not as a minor bug.
Zimbra is a common self-hosted or MSP-managed alternative to Microsoft 365 and Google Workspace, particularly for organisations that want to keep email on their own infrastructure. If that describes your setup, this is worth a same-week conversation with whoever manages the server — not a someday item on the patch list.