Zimbra CVE-2026-73570 is an actively exploited, unauthenticated remote code execution flaw in Zimbra Collaboration Suite that runs attacker commands through the optional zimbra-snmp package, and CISA added it to the Known Exploited Vulnerabilities catalog on August 21, 2026. It carries a CVSS score of 8.9, is categorized as CWE-78 (OS command injection), and affects Zimbra Collaboration before version 10.1.20, where the fix ships. Any internet-facing Zimbra server with the SNMP package installed should be treated as exposed and patched immediately.

The vulnerability follows a pattern Zimbra operators know well: unauthenticated network input reaches a helper process that passes it into a shell without sufficient sanitization, yielding code execution under the zimbra service account. From that foothold, attackers have historically dropped JSP web shells into the Jetty web roots, established reverse shells and cron persistence, and dumped mailbox contents and directory data. Mail servers are high-value because they hold credentials, address books, and the message archive itself, so a webmail RCE is rarely the end of the intrusion.

Community reaction has been weary rather than surprised. Threads across r/sysadmin and infosec circles describe "Zimbra fatigue," with recurring criticism that auxiliary components like zimbra-snmp are enabled by default and parse untrusted input. The practical takeaway defenders keep repeating is that the exposed attack surface is larger than the core mail function, and the CISA KEV listing confirms this is opportunistic, at-scale exploitation, not a theoretical risk.

Which Zimbra versions are affected, and what is the fix?

The flaw affects Zimbra Collaboration Suite before 10.1.20 when the optional zimbra-snmp package is present. Upgrading to 10.1.20 or later is the fix. If you cannot patch in the same maintenance window, disabling the SNMP service reduces the exposed surface as a stopgap, but it is not a substitute for the update.

How do I check whether a Zimbra server was already compromised?

Because exploitation predates the KEV listing, assume probing has occurred and hunt before you trust the patch. Look for unexpected .jsp or .jspx files in the Jetty webapp directories under /opt/zimbra, anomalous child processes spawned from SNMP or watchdog handlers, new cron entries under the zimbra account, and outbound connections from the mail host that do not match normal mail flow. Compare file checksums in the web roots against a known-good baseline, and review the Zimbra and mailbox access logs for the window before you applied 10.1.20.

Our read

A CVSS 8.9 that is already in KEV is the exact profile our 2025 analysis flagged as the trap in point-in-time testing: 67% of the year's actively-exploited vulnerabilities would have been missed by an annual pentest, and the median disclosure-to-exploitation gap was 26 days. Zimbra keeps compressing that gap toward zero. The verifiable-by-design move is continuous verification of your own perimeter: know which of your mail servers actually run Zimbra, at which version, with which optional packages enabled, and prove the SNMP package is patched rather than assuming it. That inventory is the difference between patching a server and discovering a web shell.

Reporting by The Hacker News; CVSS, EPSS and KEV status per NVD, FIRST.org and CISA. Sources linked above.

Related: SharePoint CVE-2026-50522 active exploitation and what CVSS and EPSS miss for patch prioritization.