CERT Polska Confirms Active Exploitation of Zimbra CVE-2026-73570 SNMP RCE
Polish CERT confirmed active exploitation of a newly patched Zimbra RCE affecting SNMP-enabled deployments. The flaw enables unauthenticated command execution and fits a multi-year pattern of mailbox server targeting documented in CISA KEV entries. No attribution evidence has been released.
The flaw was fixed in version 10.1.20 released July 20. It requires SNMP notifications enabled and permits arbitrary command execution without credentials. CERT Polska released IoCs but withheld actor details or campaign scope.
CISA KEV already lists 18 Zimbra Collaboration vulnerabilities, four added in 2024. This matches documented patterns where mailbox servers are compromised for persistence, credential harvesting, and lateral movement rather than ransomware.
Technical evidence shows repeated targeting of Zimbra by both state-linked and criminal actors, yet no independent attribution data exists for the current activity. Official statements frequently conflate observed access with specific nation-state attribution without public IOC correlation.
Enterprises must immediately disable zimbra-snmp or apply the patch. Expect CISA to add the CVE to KEV within weeks, creating compliance pressure and exposing unpatched instances to continued compromise.
CISA: CVE-2026-73570 added to KEV catalog by August 15
Sources (3)
- [1]SecurityWeek Report(https://www.securityweek.com/hackers-target-zimbra-servers-in-active-exploitation-campaign/)
- [2]CISA Known Exploited Vulnerabilities Catalog(https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [3]CERT Polska Zimbra Advisory(https://cert.pl/en/2024/07/zimbra-snmp-vuln/)