Zimbra SNMP flaw enables unauthenticated remote code execution
Synacor patched the bug before disclosing it, and exposed Zimbra servers are now being scanned at scale.
A critical unauthenticated RCE in Zimbra Collaboration Suite, tracked as CVE-2026-73570, is being actively exploited and has already been linked to mailbox theft and credential exposure. Synacor fixed it in Zimbra Collaboration Suite 10.1.20 on July 20, 2026, but did not disclose the issue publicly until August 13, giving attackers time to reverse-engineer the patch and scan internet-facing systems. The bug lives in the SNMP notification path, where log data can be turned into shell commands through the swatchdog monitoring flow. Defenders are told to move to 10.1.20 or later, or disable the SNMP package if they cannot upgrade immediately. Shadowserver says it observed about 274 compromised production instances after disclosure, and roughly 10,000 public Zimbra deployments are still exposed to scanning.
Why it matters
This leaves internet-facing Zimbra deployments with an active route to remote command execution until they are upgraded or have the SNMP package disabled. Shadowserver’s numbers show both confirmed compromise and a large exposed set, so the risk is no longer theoretical for operators running public instances.
Keep or strike?
Does this story matter, or is it hype? Mark it before you see what everyone else did.
Sources
- InfoQ