Zimbra ZCS unauthenticated OS command injection via crafted SMTP requests (CVE-2026-73570)
CERT Polska reports active exploitation and CISA's SSVC decision is 'active'; Zimbra servers not upgraded to 10.1.20 this week are exposed to unauthenticated remote command execution over SMTP.
A command injection flaw in Zimbra's SNMP monitoring component (triggered when SNMP notifications are enabled) lets an unauthenticated attacker send crafted SMTP requests that execute arbitrary OS commands as the zimbra user. Successful exploitation gives full control of the mail server and everything it stores.
Affected: Zimbra Collaboration Suite (ZCS) < 10.1.20
How to Test
Run `zmcontrol -v` to confirm the installed version; any release below 10.1.20 is vulnerable. Check whether SNMP notifications are enabled in the zimbra-snmp/monitoring configuration — the injection path requires them. Review MTA and system logs for unexpected processes or commands spawned by the zimbra user following inbound SMTP connections.
How to Patch
Upgrade to ZCS 10.1.20 immediately via `yum update` or `apt update` per your install method. If you cannot upgrade today, disable SNMP notifications in the SNMP monitoring component as an interim mitigation and restrict inbound SMTP exposure where feasible.