Zimbra command injection is being exploited; 12,100 servers exposed and SNMP config decides who is hit

CERT Polska reported on Monday that threat actors are actively exploiting CVE-2026-73570, a command injection flaw in Zimbra Collaboration Suite that gives unauthenticated attackers remote code execution ^[1][6]. Shadowserver currently tracks more than 12,100 Zimbra servers exposed online, and there is no public figure for how many of those have already applied the fix or are honeypots ^[7][10].

The patch is not new. Zimbra shipped version 10.1.20 on July 20 to close the hole ^[3]. According to the advisory, improper sanitization of untrusted input during SNMP notification processing lets an unauthenticated attacker send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user ^[5].

Two details in that sentence matter more than the CVSS-shaped panic around it. First, the vulnerable path is the SNMP monitoring component and it is reachable when SNMP notifications are enabled ^[4]. Version inventory alone will not tell you whether a given host was ever a target; the notification configuration does. Second, code runs as the zimbra service account, not root ^[5]. That is not comforting - the zimbra user owns the mail store and the Jetty webapp directories - but it does shape what post-exploitation looks like and what a containment plan needs to cover.

CERT Polska's hunting guidance is concrete, which is rare enough to follow literally. Admins are asked to check logs for suspicious activity such as the Zimbra service restarting on its own, and for files created by user zimbra in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/ and /tmp/ over the last 30 days ^[8]. The 30-day window is the tell: the assumption is that exploitation may predate the public warning, so patching now without looking backwards leaves a webshell in place on a host you have declared clean.

Scale is what makes this worth the effort. Zimbra is used by hundreds of millions of people and organizations, including thousands of businesses and hundreds of government agencies ^[2]. Of the exposed servers Shadowserver counts, 4,382 are in Europe and 4,492 in Asia ^[7], which is 8,874 between them, or roughly 73 percent of the total ^[11].

The attacker interest is established rather than speculative. Russian-linked Winter Vivern used a reflected XSS exploit against Zimbra webmail in February 2023 to steal email from NATO-aligned targets ^[12]; US and UK agencies warned in October 2024 that APT29 was targeting vulnerable Zimbra servers ^[13]; and in March, Seqrite Labs reported APT28 exploiting a stored XSS flaw against Ukrainian government ZCS servers ^[14].

What to watch: whether the Shadowserver exposure count falls meaningfully in the next few weeks, since a patch a month old that is still the deciding control implies slow uptake ^[3][7]; whether anyone publishes indicators beyond file-creation paths, which would let defenders distinguish scanning from successful execution ^[8]; and whether the espionage groups with Zimbra track records adopt this chain, given they have historically preferred credential and email theft over noisy shells ^[12][13][14].