External risk intelligence

Zimbra Collaboration OS Command Injection Vulnerability via SNMP Notifications.

CVE advisoryKnown Exploit

CVE-2026-73570

Zimbra Collaboration Suite is commonly deployed as an internet-facing email and collaboration server. While the vulnerability requires the specific optional zimbra-snmp package to be installed and active, the product role itself is frequently exposed to the public internet to facilitate mail delivery and remote access.

OS Command Injection

Synacor Zimbra Collaboration Suite

before 10.1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Zimbra Collaboration Suite, specifically when the optional zimbra-snmp package is enabled. This issue allows for remote code execution, meaning an attacker could potentially run commands on the affected system without needing any prior authentication. The primary concern is to confirm if this specific configuration is in use within our environment.

Unauthenticated remote code execution in Zimbra.
Attackers can run system commands.
Confirm if optional SNMP package is enabled.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could target Zimbra Collaboration if the optional SNMP package is installed and enabled. By sending specially crafted SMTP requests, an attacker could exploit improper input handling to execute arbitrary operating system commands on the server.

Network access and optional package installed.
Specially crafted SMTP requests.
Arbitrary command execution as Zimbra user.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary operating system commands on a Zimbra Collaboration server when the optional zimbra-snmp package is installed and SNMP notifications are enabled. This could affect the integrity and availability of the server and any data it processes.

System commands on the server.
Via crafted SMTP requests.
Server compromise and data impact.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this vulnerability likely falls to the Zimbra platform administration team, in conjunction with the network and security teams responsible for monitoring and securing external-facing services. The first practical step involves identifying all Zimbra Collaboration Suite instances, specifically those with the optional zimbra-snmp package enabled and SNMP notifications active. Once located, confirm their internet reachability and business criticality, identify the accountable owner, and then prioritize remediation based on exposure and impact.

Zimbra platform and security teams own the issue.
Verify SNMP enabled and internet exposure.
Plan risk-based remediation or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Zimbra Collaboration Suite (ZCS)?

Zimbra Collaboration Suite is an enterprise-grade email, calendar, and collaboration platform. It serves as a central hub for organizations to manage communications and document sharing. Because it is designed to handle email delivery and remote user access, it is standard for these servers to operate as internet-facing services.

What does CVE-2026-73570 mean for security?

This vulnerability is an OS command injection flaw, identified as CWE-78. In simple terms, the software fails to properly clean incoming data, allowing an attacker to inject their own operating system commands into the server. Because the application processes these inputs, it may inadvertently execute them, effectively granting the attacker the same system permissions as the Zimbra user.

Can any Zimbra installation be triggered by this?

No. The vulnerability is specific to environments where the optional zimbra-snmp package is both installed and has notifications enabled. If this package is absent or the notification feature is disabled, the specific path required for this command injection does not exist, and these crafted SMTP requests will not trigger the vulnerability.

How do I know if my server is at risk?

You should check if your environment has the optional SNMP component active. According to Halo Surface Signal, the core risk is elevated because ZCS is frequently deployed with direct exposure to the public internet to facilitate mail services. If your instance is internet-facing and uses the vulnerable SNMP configuration, it is reachable by remote attackers.

What is the first step to address this?

Begin by auditing your Zimbra deployments to confirm which servers have the optional zimbra-snmp package installed and configured. Once you identify these instances, assess their network reachability. Coordinate with your platform administration team to prioritize updates or changes to the SNMP configuration in alignment with the official vendor security advisories.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.