Do I need to be logged in for this attack to work?
No. CVE-2026-73570 is unauthenticated, meaning an attacker who can reach a vulnerable server does not need a username or password.
7 minutes reading time
(1378 words)
Zimbra Email Servers Hacked Before the Flaw Was Even Announced: What You Need to Know
A fix for a critical Zimbra email server flaw was available for more than three weeks before the public was told about it, and attackers used that time. Microsoft Threat Intelligence reports that threat actors exploited CVE-2026-73570 (CVSS 8.9), an unauthenticated operating system command injection vulnerability in the Zimbra Collaboration Suite, for weeks before it was disclosed. The Shadowserver Foundation counted 274 compromised Zimbra servers in a single recent week.
If your organization runs Zimbra for email and calendars, or relies on a hosting provider that does, here is what happened, why this case says something important about how fast attackers now move, and what to do about it.
What Is Zimbra, and What Went Wrong?
Zimbra Collaboration Suite is an email, calendar, and collaboration platform used by businesses, schools, governments, and hosting providers around the world. It is maintained by Synacor and is often chosen as an alternative to Microsoft Exchange.
The vulnerability lives in Zimbra's SNMP notification feature, provided by the optional zimbra-snmp package. SNMP (Simple Network Management Protocol) is a common way for servers to send status alerts to monitoring tools. Because of the flaw, an attacker can inject operating system commands through that notification path, and no username or password is required.
No login required: crafted input travels the SNMP notification path and runs as a system command.
The Timeline: A Head Start for Attackers
The order of events is what makes this case stand out:
- July 20, 2026: Synacor released Zimbra Collaboration Suite 10.1.20, which contained the fix.
- Before disclosure: Microsoft observed two distinct out-of-band scanning tools probing the vulnerable injection point, using the same "swatchdog-to-snmptrap" execution path later seen in actual exploitation.
- August 13, 2026: The vulnerability was publicly disclosed.
- August 21, 2026: CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies just three days to fix it.
Late September 2026: Shadowserver data showed 274 compromised Zimbra instances in a single week.
The fix was available on July 20, but many organizations did not know they needed it until August 13.
Why This Matters: Attackers Read Patches Too
Many organizations wait for a headline, an alert, or a vendor email before treating an update as urgent. This case shows why that approach is risky.
As one SANS NewsBites editor observed, the activity implies that attackers are reverse-engineering vendor patches and building working exploits faster than standard organizational patch cycles can keep up. When a vendor quietly ships a fix, skilled attackers can compare the old and new code, figure out what was repaired, and turn that into an attack, all before most customers realize anything important has changed.
The conclusion: automatic, fast patching of internet-facing systems needs to become routine, not a special event triggered by news coverage.
Why Email Servers Are High-Value Targets
An email server is one of the most sensitive systems a business owns. A successful attack on Zimbra could give an attacker:
- Full control of the server and access to every mailbox it hosts
- Sensitive conversations, contracts, invoices, and attachments
- Password reset emails for other business systems and cloud services
- The ability to send convincing phishing or invoice-fraud emails from your real domain
- A foothold to move deeper into your network
- Persistent backdoors that remain after the server is patched
The Bigger Lesson: Do Not Forget About SNMP
SNMP is one of those "set it and forget it" technologies that quietly runs on servers, printers, switches, and firewalls. Lee Neely suggested an exercise that he admits may draw eye-rolls from IT staff: ask how your SNMP services are secured. If one SNMP weakness is being exploited, it is likely that attackers are looking for others.
Quick wins for SNMP across your whole environment, not just Zimbra.
| SNMP version | Security level | Recommendation |
| SNMPv1 | Plain-text community string, no encryption | Retire wherever possible |
| SNMPv2c | Plain-text community string, no encryption | Replace defaults; plan to migrate |
| SNMPv3 | Authentication and encryption supported | Preferred: use with authPriv mode |
How to Protect Your Organization Now
1. Update to Zimbra 10.1.20 or later. Confirm the installed version on every Zimbra server, including test, backup, and disaster recovery systems.
2. Remove zimbra-snmp if you do not need it. If you are not using SNMP notifications, uninstall the package to eliminate this attack path entirely.
3. Check for signs of compromise. Use the indicators of compromise and MITRE ATT&CK techniques in Microsoft's report to review logs and servers, particularly if you updated after mid-July.
4. Harden SNMP everywhere. Use SNMPv3 with authentication and encryption, replace default or shared community strings, and limit SNMP traffic to your monitoring systems.
5. Automate patching for internet-facing systems so critical fixes are applied within days, not weeks.
6. Rotate credentials for Zimbra administrators and any accounts whose passwords may have passed through the server.
7. Revisit your email platform. If keeping a self-hosted mail server patched and monitored is a burden, a managed or cloud email service may reduce your risk.
Running Zimbra and not sure whether you are on a safe version? LBT Technology Group, LLC. can verify your version, check for indicators of compromise, harden SNMP across your network, and set up automated patching. Contact our team for a quick review.
The Bottom Line
CVE-2026-73570 shows that the race between attackers and defenders often starts the day a fix ships, not the day a vulnerability makes the news. Attackers had a weeks-long head start on Zimbra, and hundreds of servers have paid the price. Update to 10.1.20, remove what you do not use, lock down SNMP, and build a patching process that does not wait for headlines.
Frequently Asked Questions
We don't use SNMP notifications. Are we safe?
The vulnerability is in the zimbra-snmp package. If it is installed, you should update regardless. If you do not use it, uninstalling it removes this attack path. Either way, update to 10.1.20 or later
Our email is hosted by a provider that uses Zimbra. What should we do?
Ask your provider to confirm in writing that its servers run Zimbra 10.1.20 or later, when the update was applied, and whether it has checked for the indicators of compromise Microsoft published.
Why did the fix come out before the vulnerability was announced?
Vendors sometimes release fixes before full disclosure to give customers time to patch. The risk is that attackers can analyze the update to discover the flaw, which is why fast patching matters even when an update is not labeled urgent.
Sources & Further Reading
Zimbra SNMP Flaw Under Active Exploitation (CVE-2026-73570) – Lab Space
Key Takeaways CVE-2026-73570 is an unauthenticated OS command injection flaw (CVSS 3.1: 8.9) in the optional SNMP notification component of Zimbra Collaboration Suite (ZCS), patched in version 10.1.20 on July 20, 2026, and now under active exploitation.
Zimbra vulnerability CVE-2026-73570: find impacted assets
Zimbra discloses critical unauthenticated RCE flaw CVE-2026-73570 (CVSS 8.9). Learn how SMTP snmp_notify exploits occur and upgrade to 10.1.20 immediately.
CVE-2026-73570 – Zimbra Collaboration | Action1
Zimbra Collaboration before 10.1.20 is affected by a remote code execution vulnerability when the optional zimbra-snmp package is installed and SNMP notifications are enabled. An unauthenticated attacker can send crafted SMTP requests that execute operating system commands as the Zimbra user. The CVSS score is 8.9, which is High severity. CVE-2026-73570 is confirmed as actively
