[HIGH PRIORITY] Zimbra Collaboration SNMP Command Injection RCE (CVE-2026-73570)

⚠ HIGH PRIORITY — CISA KEV (Aug 21, 2026). CVE-2026-73570 is an unauthenticated OS command injection in Zimbra Collaboration Suite (ZCS) before 10.1.20. Attackers send crafted SMTP requests that reach SNMP notification handling — executing arbitrary commands as the zimbra user. Active exploitation has compromised hundreds of internet-facing mail servers.

Affected Zimbra

• ZCS builds before 10.1.20 (10.1.19 does NOT fix this CVE)
• Hosts with optional zimbra-snmp package installed
• SNMP notifications enabled (non-default but common in monitored deployments)
• Linux mail servers on Ubuntu/RHEL with SMTP port 25/587 reachable

Check if vulnerable

su - zimbra -c 'zmcontrol -v'
rpm -q zimbra-snmp 2>/dev/null || dpkg -l | grep zimbra-snmp
zmprov gs $(zmhostname) | grep -i snmp

Patching Method

1. Upgrade every ZCS node to 10.1.20 or later via Zimbra patch procedure.
2. Run zmcontrol restart on each mailbox/LDAP node after upgrade.
3. Verify version: zmcontrol -v shows 10.1.20+ on all nodes.
4. Review /var/log/zimbra.log and audit.log for SMTP anomalies.
5. Hunt for persistence: cron jobs, new zimbra-user SSH keys, rogue JSP files.
6. Rotate zimbra LDAP and admin passwords if exploitation suspected.
7. Re-scan with Shadowserver/CISA forensics guidance if internet-facing and unpatched.

su - zimbra -c 'zmcontrol -v'
grep -i snmp /opt/zimbra/log/mailbox.log | tail -50

Workaround until patched

• Remove or disable zimbra-snmp package — eliminates vulnerable code path
• Disable SNMP notifications in Zimbra admin if SNMP package must remain
• Not a substitute for 10.1.20 upgrade — apply patch in same maintenance window

CVSS: 8.9 High. Federal remediation deadline: 24 Aug 2026.