Zimbra Collaboration Vulnerability Allows Remote Code Execution via SNMP (CVE-2026-73570)

by

Zimbra Collaboration Vulnerability Allows Remote Code Execution via SNMP (CVE-2026-73570)

JPCERT/CC has reported a critical OS command injection vulnerability in Zimbra Collaboration (ZCS). The issue, identified as CVE-2026-73570, introduces a Remote Code Execution (RCE) risk that requires specific configuration conditions to be met.

Technical Analysis

The vulnerability affects ZCS versions prior to 10.1.20. Unlike many generic web vulnerabilities, this one has a narrow attack surface. It is only exploitable when two specific conditions coincide:

  1. The optional zimbra-snmp package is installed.
  2. SNMP notifications are enabled.

The flaw stems from improper sanitization of untrusted input during SNMP notification processing. An unauthenticated attacker can send specially crafted SMTP requests to trigger the vulnerability.

Successful exploitation allows the attacker to execute arbitrary operating system commands with the privileges of the Zimbra user.

Current Status and Mitigation

CISA has confirmed active exploitation of this vulnerability and has added it to the Known Exploited Vulnerabilities (KEV) catalog. Given the confirmed exploitation, immediate remediation is recommended.

The vendor advises updating to the fixed version, ZCS 10.1.20 or later, to resolve the issue.