A patched security vulnerability in Zimbra Collaboration (ZCS), tracked as CVE-2026-73570 with a CVSS score of 8.9, is being actively exploited in the wild. The flaw is a command injection vulnerability that enables unauthenticated remote code execution. The active exploitation was reported by CERT Polska (Polish Computer Emergency Response Team). The vulnerability resides in Zimbra's SNMP component and allows remote attackers to execute arbitrary commands without authentication. Organizations running affected versions of Zimbra Collaboration are urged to apply the available patch immediately. The high CVSS score reflects the critical nature of the flaw, given its unauthenticated and remote exploitability.
CVE-2026-73570 is a command injection vulnerability (CVSS 8.9) in Zimbra Collaboration Suite (ZCS) affecting versions before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated remote attacker can send specially crafted SMTP requests that result in execution of arbitrary OS commands as the Zimbra user. Active exploitation has been confirmed by CERT Polska. A separate related campaign by Russia-linked threat actor Laundry Bear (CL-STA-1114, TA488, UNK_PitStop, Void Blizzard) exploited CVE-2025-66376, a stored XSS vulnerability in Zimbra's Classic UI, to deliver a malicious JavaScript payload called ZimReaper targeting Western government and commercial Zimbra mail servers since at least July 2025 for email harvesting and sensitive data collection.
1. Upgrade Zimbra Collaboration Suite to version 10.1.20 or later immediately. 2. If unable to patch immediately, consider disabling the zimbra-snmp package or disabling SNMP notifications to reduce attack surface. 3. Review /var/log/zimbra.log for suspicious Zimbra service restarts. 4. Check the following directories for any files created within the last 30 days: /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/. 5. Monitor for unusual SMTP requests indicative of exploitation attempts. 6. Investigate any signs of the ZimReaper JavaScript payload if CVE-2025-66376 is also a concern.
/var/log/zimbra.log - suspicious Zimbra service restarts, /opt/zimbra/jetty/webapps/ - suspicious files created in last 30 days, /opt/zimbra/jetty_base/webapps/ - suspicious files created in last 30 days, /tmp/ - suspicious files created in last 30 days, ZimReaper - malicious JavaScript payload
