A Patch Existed for a Month Before Anyone Attacked It
Zimbra shipped a fix for CVE-2026-73570 on July 20, 2026, and CERT Polska did not confirm active exploitation of the same flaw until August 21, 2026, a 28-day gap in which any unpatched server sat exposed to a live, unauthenticated exploit chain.
The vulnerability carries a CVSS score of 8.9 and is an OS command-injection flaw affecting every version of Zimbra Collaboration Suite (ZCS) before 10.1.20, the version Zimbra released on July 20, 2026 specifically to close it.
The Bug Lives in an Add-On Most Admins Forget They Enabled
The flaw sits in how Zimbra Collaboration Suite processes SNMP trap notifications through a background service called swatchdog, which only runs when the optional zimbra-snmp package is installed and SNMP notifications are switched on through the snmp_notify parameter.
Improper sanitization of untrusted input during that SNMP notification processing lets an unauthenticated attacker send a specially crafted request that executes arbitrary OS commands with the privileges of the zimbra user, and no login is required to trigger it.
Washington Got a Three-Day Deadline; Europe Got None
On August 21, 2026, the US Cybersecurity and Infrastructure Security Agency added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog, triggering a binding three-day remediation deadline under Binding Operational Directive 22-01 for US federal civilian agencies alone, with no equivalent deadline forcing the hand of any other Zimbra operator.
| Date | Event |
|---|---|
| 20 July 2026 | Zimbra releases version 10.1.20, patching CVE-2026-73570 |
| 21 August 2026 | CERT Polska confirms active exploitation in the wild |
| 21 August 2026 | CISA adds the flaw to its Known Exploited Vulnerabilities catalog |
| 24 August 2026 | US federal civilian agencies must remediate under BOD 22-01 |
That three-day clock cannot be exported; a Zimbra operator in Germany, Poland, or France has to set the deadline for themselves, because CISA's directive binds only US federal civilian agencies.
Zimbra Is Common in Europe for the Same Reason It Is a Target
Zimbra Collaboration Suite is a widely used self-hosted alternative to Microsoft Exchange among European small and mid-sized businesses, universities, and public-sector bodies that chose it specifically to keep mail infrastructure off US hyperscaler platforms, and that same self-hosted, budget-conscious population is the one least likely to have an external mandate forcing it to patch.
That absence of an external clock, not any special vulnerability in Zimbra itself, is why the population most likely to still be running an older ZCS build with the SNMP add-on switched on is also the population least likely to notice this advisory.
What CERT Polska Says to Check on Your Own Server Today
CERT Polska's advisory gives operators a way to check whether they were already hit, not only whether they are now patched, starting with the Zimbra service log itself: check /var/log/zimbra.log for suspicious Zimbra service stop and restart cycles, which CERT Polska identifies as the signature of a malicious command executing disguised as a routine service restart.
From there, check /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ for any file created in the last 30 days that you cannot account for, confirm your ZCS version and upgrade to 10.1.20 if you have not already, and if your organization does not use SNMP trap notifications, remove the zimbra-snmp package entirely rather than leaving it installed and unconfigured - nobody is going to send you a deadline to do it.
Read next: A German-Made PLC Is Now a Live Cyberweapon Target | CISA Gives TrueConf Users 3 Days to Patch Two Flaws
