← News
/DISPATCH · 2026-08-23

CVE-2026-73570: Zimbra Collaboration Suite SNMP Command Injection Weaponized; CISA KEV Sets Remediation Deadline

Zimbra Collaboration Suite disclosed CVSS 8.9 high-severity command injection CVE-2026-73570. Unauthenticated SMTP triggers SNMP trap injection and RCE as user zimbra. Fixed in Zimbra 10.1.20; CERT Polska confirmed in-the-wild use 28 days after the patch. ~4,500 self-hosted instances remain exposed in Asia.

Vulnerability Overview and Incident Background

On 17 August 2026, Poland's Computer Emergency Response Team CERT Polska published Alert 145/2026, confirming active exploitation of an OS command injection in Zimbra Collaboration Suite (ZCS). On 21 August, CISA added CVE-2026-73570 to the Known Exploited Vulnerabilities (KEV) catalog and required Federal Civilian Executive Branch agencies to remediate by 24 August. Zimbra shipped the fix in 10.1.20 on 20 July, but 28 days of weak exposure hunting and upgrades left more than 12,100 reachable Zimbra instances worldwide per Shadowserver; Asia and Europe each account for nearly 4,500.

CVSS 3.1 score 8.9, official rating High. No authentication required. A crafted SMTP message to the target Zimbra server triggers arbitrary OS command execution on the SNMP notification path, as the zimbra system user. That identity can read/write the mail store, change configuration, plant a JSP web shell, then pivot through trusted mail-relay relationships against partner orgs.

Technical Details: SNMP Trap Notification Injection Point

Root cause is not the mail protocol stack. It lives in Zimbra's SNMP network-monitoring notification module. When admins install the zimbra-snmp package and enable SNMP traps via snmp_notify, the system calls swatchdog to parse inbound SMTP and build SNMP notification messages. swatchdog concatenates SMTP fields (subject, sender, etc.) straight into the final system command string with no escaping or allowlist—classic OS Command Injection (CWE-78).

`sub send_snmp_notification {
    my ($smtp_data) = @_;
    # Root cause: concatenated without sanitization
    my $notification_msg = $smtp_data->{'subject'};
    my $cmd = "snmptrap -v 2c -c public localhost ZIMBRA-MIB::alert && echo $notification_msg";
    system($cmd);  # executed with zimbra user privileges
}`

Public PoC pins the injection on the backup extension endpoint /service/extension/backup/snmptrap. Request parameter snmp_notify carries a payload such as 127.0.0.1; id #: semicolon ends the original command, attacker command is inserted, hash comments out the rest. swatchdog is enabled by default at Zimbra install, so the attack surface is larger than whether zimbra-snmp is optional.

Attack chain: fingerprint ZCS version → deliver SMTP mail with command-injection payload → swatchdog fires SNMP notification → command runs as zimbra → plant JSP web shell → steal mail credentials and historical mail → lateral phishing via trusted mail channels.

Impact Assessment: Asia Self-Hosted Mail Clusters Hit Hardest

CWE-78 plus inherent internet exposure of self-hosted mail servers makes this more than a routine RCE advisory. Zimbra is still widely self-hosted in large government agencies, public universities, hospitals, and mid-size enterprises in Indonesia, Vietnam, and India. Patch cadence is typically monthly; complete SBOMs and optional-package inventories are rare. Operators who know whether they use SNMP still may not know whether zimbra-snmp was installed years ago by a departed colleague. Shadowserver and multiple threat-intel firms confirmed active exploitation from follow-on infrastructure of Russia-linked group Laundry Bear (CL-STA-1114 / TA488 / Void Blizzard), which has run long-term espionage against Western and Asian government mail servers via Zimbra bugs including CVE-2025-66376 since July 2025.

CVSS Score and Exploit Complexity

Remediation and Temporary Mitigations

Immediate Actions

Intrusion Hunt Checklist

Hardening

The zimbra user is not root, but it is enough to take over the org's mail ecosystem. Organizations still on old Zimbra should immediately run upgrade, hunt, and credential rotation. Authoritative sources: CERT Polska advisory and CISA KEV. Do not let unauthenticated RCE pull you into the next mail-data breach.

References