Full research report
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
Executive assessment
The strongest evidence is CERT Polska's direct warning that CVE-2026-73570 is under active exploitation, corroborated by matching NVD and Zimbra descriptions of the vulnerable SNMP notification component and the 10.1.20 fix. Exposure is conditional rather than universal: the optional zimbra-snmp package and SNMP notifications must be enabled, and the attack arrives through unauthenticated SMTP input. Public details stop short of naming attackers, victims or payloads, so attribution and campaign impact remain unresolved. CVE-2025-66376, Laundry Bear and ZimReaper describe a separate webmail cross-site scripting campaign and should not be used to infer who is exploiting the new command-injection flaw.
What happened
Zimbra fixed CVE-2026-73570 in Collaboration version 10.1.20 in July 2026. On 17 August, CERT Polska warned that the operating-system command-injection flaw was being actively exploited and described an ongoing campaign, with public reporting following on 20 August. CVE-2025-66376 concerns a different Classic UI cross-site scripting vulnerability and appears in the story only as historical context about prior Zimbra exploitation.
Affected scope
Zimbra Collaboration before 10.1.20 where the optional zimbra-snmp package is installed and SNMP notifications are enabled; CERT Polska additionally identifies the normally enabled swatchdog service as part of the vulnerable configuration. The affected sectors, organisations, victim count and geographic reach of the current campaign have not been disclosed.
Technical assessment
Improper sanitisation during SNMP notification processing allows an unauthenticated party able to submit crafted SMTP requests to cause operating-system commands to run as the zimbra service account. This creates a remote code-execution boundary crossing on a mail-facing service, although the published CVSS vector records high attack complexity and the vulnerable optional configuration must be present. CERT Polska's detection advice indicates attackers may trigger suspicious service-state changes and create files under Zimbra web-application or temporary directories.
Recommended defensive actions
- Immediately update affected Zimbra Collaboration installations to version 10.1.20 or later.
- Inventory installations for the optional zimbra-snmp package, enabled SNMP notifications and the swatchdog service to identify the exposed subset.
- Hunt /var/log/zimbra.log for anomalous service status changes, especially unexpected stopped-to-running and running-to-stopped transitions.
- Inspect files created by the zimbra user during the preceding 30 days under /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/ and /tmp/.
- Isolate potentially compromised servers and investigate newly deployed web content, unexpected processes, persistence and mailbox access before returning them to service.
- Review exposure of SMTP services and restrict unnecessary access without disrupting legitimate mail delivery.
Uncertainties and evidence gaps
- CERT Polska has not publicly identified the current attacker, victims, campaign scale, payloads or post-exploitation objectives.
- No reliable public evidence links Laundry Bear, ZimReaper or CVE-2025-66376 to the current CVE-2026-73570 exploitation.
- The only purported public exploit repository found was newly created, had no independent validation and described a route inconsistent with the authoritative SMTP-based vulnerability description.
- The available advisories do not establish whether exploitation produces consistent network indicators or whether attackers have obtained privileges beyond the zimbra account.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Confirmed active exploitation of CVE-2026-73570; a purported public PoC is unvalidated, while CVE-2025-66376 was exploited in a separate prior Laundry Bear campaign.
The investigation began by testing the report's central claim that a newly patched Zimbra SNMP flaw was being exploited, then separated that event from the article's reference to an older Laundry Bear campaign. Zimbra, NVD and CERT Polska independently established the vulnerable configuration, fixed release and active-exploitation status for CVE-2026-73570. CISA and NVD showed that CVE-2025-66376 is a separate, historically exploited cross-site scripting flaw, while review of the only apparent public exploit repository found significant credibility problems.
- What precise event and claims did the supplied article describe?Read the initial report and followed its links to the cited vulnerability, vendor and CERT records.thehackernews.com ↗
The report alleged active exploitation of CVE-2026-73570 after a July fix and separately mentioned CVE-2025-66376 in a prior Laundry Bear campaign.
why This established that active SNMP-flaw exploitation and the historical espionage campaign needed to be verified independently rather than treated as one attack.
- What is the authoritative technical scope of CVE-2026-73570?Reviewed the National Vulnerability Database record.nvd.nist.gov ↗
The flaw affects Zimbra Collaboration before 10.1.20 when zimbra-snmp and SNMP notifications are enabled; crafted unauthenticated SMTP requests can execute commands as the zimbra user.
why This confirmed the CVE, required configuration, access path and impact while ruling out claims that all Zimbra deployments are equally exposed.
- Did the vendor release a fix, and in which version?Checked Zimbra's security advisory table.wiki.zimbra.com ↗
Zimbra describes a command-injection flaw in the SNMP monitoring component and records 10.1.20 as the fixed release.
why The vendor record corroborated NVD and provided a concrete remediation target.
- Is exploitation confirmed by a primary incident-response authority?Read and translated the operational details in CERT Polska's 17 August bulletin.moje.cert.pl ↗
CERT Polska explicitly reported active exploitation, identified snmp_notify and swatchdog conditions, and supplied log and filesystem checks for the previous 30 days.
why This elevated exploitation from media reporting to a confirmed operational warning and supplied defensible hunting actions.
- How does CISA classify the two CVEs?Reviewed CISA's current Known Exploited Vulnerabilities catalogue data for both identifiers.cisa.gov ↗
CVE-2025-66376 was added on 18 March 2026; CVE-2026-73570 was not present when reviewed.
why This confirms historical exploitation of the older flaw but does not weaken CERT Polska's independent confirmation of current CVE-2026-73570 exploitation.
- Is public exploit code available for CVE-2026-73570?Searched GitHub repositories for the exact CVE identifier.github.com ↗
One newly created, zero-star repository claimed to provide a PoC.
why The result required direct technical review before it could be characterised as evidence of usable public exploit code.
- Does the purported PoC credibly implement the documented vulnerability?Inspected the repository's exploit file without executing it.
The script targets speculative HTTP extension paths, whereas NVD documents crafted SMTP requests; it also contains signs of incomplete or generic code.
why A public claim exists, but it is not reliable evidence that a working PoC is available.
- Is CVE-2025-66376 part of the same technical issue?Reviewed its NVD record.nvd.nist.gov ↗
It is a stored cross-site scripting flaw in Zimbra's Classic UI, affecting 10.0 before 10.0.18 and 10.1 before 10.1.13, rather than the SNMP component.
why This confirmed that the second CVE is contextual and must not be folded into the current command-injection event.
- What actor and malware claims are supported for the historical context?Read the multinational CISA advisory on the earlier Zimbra campaign.cisa.gov ↗
CISA attributes exploitation of CVE-2025-66376 to Russian state-supported Laundry Bear activity targeting Western government and commercial organisations; it does not discuss CVE-2026-73570.
why Laundry Bear and ZimReaper can be retained as historical context only, with no attribution to the current exploitation.
Research coverage
All 68 registered source leaves were evaluated for this run: 55 completed, 0 were unavailable, 6 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 50 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1673 records | Primary evidence3 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research. |
| NVDcve | ok900 records | Primary evidence2 matched items | Supplied a vendor or government advisory opened and verified during focused research. Supplied independent analysis opened and verified during focused research. |
| The Hacker Newsnews | ok16 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok | Context2 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok686 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1009 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| GitHub topic: exploitresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| GitHub topic: penetration-testingresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| GitHub topic: pocresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| GitHub topic: vulnerabilityresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 12 opened outside the registered collection
Vulnerability & exploitation3
Vendor & gov advisories5
Primary 17 August 2026 warning confirming active CVE-2026-73570 exploitation and providing host-level detection guidance.
Vendor record identifies the SNMP command-injection fix in Zimbra Collaboration 10.1.20.
Documents the affected configuration, unauthenticated SMTP attack surface, command execution as the zimbra user and CVSS 8.9 CNA score.
Covers the separate Laundry Bear campaign exploiting CVE-2025-66376; it provides historical Zimbra targeting context but does not attribute CVE-2026-73570 exploitation.
Lists CVE-2025-66376 as known exploited from 18 March 2026 but did not list CVE-2026-73570 when reviewed.
Analysis & research2
Initial reporting connected the July patch with CERT Polska's August exploitation warning and separately referenced the earlier Laundry Bear campaign.
Confirms that the contextual CVE is a distinct stored cross-site scripting flaw affecting older Zimbra 10.0 and 10.1 releases.