CERT Polska says CVE-2026-73570, a recently patched Zimbra Collaboration flaw, is being actively exploited in the wild. The issue affects systems with the optional zimbra-snmp package and SNMP notifications enabled, allowing unauthenticated attackers to run arbitrary OS commands as the Zimbra user. #CVE-2026-73570 #ZimbraCollaboration #CERTPolska
Keypoints
- CVE-2026-73570 was patched in Zimbra Collaboration Suite version 10.1.20.
- The flaw is present when the optional zimbra-snmp package and SNMP notifications are enabled.
- Attackers can exploit it without authentication to execute OS commands as the Zimbra user.
- CERT Polska reported active exploitation and shared indicators of compromise.
- Compromised Zimbra servers can be used for persistence, email access, credential theft, and lateral movement.
Read More: https://www.securityweek.com/hackers-target-zimbra-servers-in-active-exploitation-campaign/