CVE-2026-73570: Zimbra Command Injection via SNMP Is Being Exploited—Update to 10.1.20 and Check for Compromise
A crafted email is all it takes: On Zimbra servers with the zimbra-snmp package and SNMP notifications enabled, attackers can execute commands as the zimbra user without authentication (CVE-2026-73570, CVSS 8.9). The vulnerability is being exploited and was fixed in 10.1.20. Update, apply the workaround until then, and check for web shells and persistence.
October 6, 2026 Vulnerabilities 8 min read
