Zimbra email servers under active attack via obscure SNMP flaw

A remote code execution flaw in Zimbra Collaboration Suite, the self-hosted email and calendar platform used by businesses, universities and government bodies, is being actively exploited in the wild. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue on 21 August 2026, giving US federal agencies until 24 August to patch or mitigate — a tight three-day window that CISA reserves for bugs it considers genuinely dangerous, not theoretical.

What the bug actually does

The flaw, tracked as CVE-2026-73570, lives in versions of Zimbra Collaboration Suite (ZCS) before 10.1.20. According to the official vulnerability record, it only triggers when the optional zimbra-snmp package is installed and SNMP notifications are switched on. When that’s the case, the software fails to properly sanitise input during SNMP notification processing. An attacker with no login credentials at all can send a specially crafted SMTP request that tricks the server into running arbitrary operating system commands as the “zimbra” user — effectively handing them a foothold on the box.

MITRE’s own scoring rates this 8.9 out of 10 on the CVSS 3.1 scale, classed as HIGH severity, largely because it needs no authentication and no user interaction to work. NVD itself hasn’t published its own severity assessment yet, so the 8.9 figure comes from the vulnerability’s original reporting body rather than an independent NIST review.

So who is actually at risk

This is not a consumer issue. Zimbra is server software that organisations run themselves to host their own email and calendars — it has nothing to do with Gmail, Outlook.com or any other webmail service ordinary readers might use. If you don’t administer a mail server, this bug simply doesn’t touch you.

Even among Zimbra administrators, exposure depends on a specific configuration choice. The optional SNMP monitoring package has to be installed, and SNMP notifications have to be turned on — neither of which is the default setup for most Zimbra deployments. Anyone running a standard install without SNMP enabled isn’t vulnerable to this particular flaw, regardless of version.

CISA’s entry lists the ransomware connection as “Unknown,” meaning there’s no confirmed link yet to extortion gangs, though that’s worth watching rather than dismissing. What is confirmed, per CISA’s classification, is that exploitation is happening now, not merely possible in theory.

What to do about it

Zimbra administrators should check whether their servers are running a version earlier than 10.1.20 and, separately, whether the zimbra-snmp package and its notifications are active. If both apply, CISA’s advice is to apply the vendor’s mitigations without delay, in line with its wider guidance on prioritising security patches by actual risk rather than working through a backlog alphabetically. Federal US agencies are contractually bound to the 24 August deadline, but any organisation running Zimbra would be sensible to treat it the same way, given exploitation is already under way.

The takeaway

This is a genuinely serious flaw for a genuinely narrow slice of Zimbra users — those who’ve opted into SNMP monitoring on an unpatched server. If that’s not your setup, there’s nothing to do here beyond noting that yet another piece of enterprise infrastructure has been caught out by a feature few people realised they’d switched on. If it is your setup, patch now rather than later.