On September 30, 2026, Microsoft published an analysis of CVE-2026-73570 exploitation on Internet-facing Zimbra servers. This command injection in SNMP notification processing can be triggered without authentication when the optional zimbra-snmp package is installed, SNMP notifications are enabled and swatchdog is running. CERT Polska reported active exploitation on August 17; CISA added the vulnerability to its KEV catalog on August 21.
Zimbra shipped the fix in version 10.1.20 on July 20, 2026, before public disclosure in August. Microsoft describes intrusions involving web shells, persistent access and mailbox-data collection. It observed an attempted data transfer, but its report does not confirm that the transfer succeeded. Version 10.1.21, released later, contains separate additional security fixes.
What CVE-2026-73570 enables
An attacker can send a specially crafted SMTP email that reaches Zimbra’s SNMP notification processing. If zimbra-snmp is installed, notifications are enabled and swatchdog is running, attacker-controlled input can be interpreted as a command by the monitoring mechanism and run with the privileges of the zimbra service account.
This does not mean every Zimbra server is equally exposed. Check the installed version, presence of the optional package and SNMP notification configuration.
What Microsoft observed
Microsoft reports reconnaissance before public disclosure, followed by confirmed intrusions. On investigated servers, attackers installed JSP web shells and persistent access, attempted privilege escalation, and collected mailbox-related data.
In one case, attackers archived mailbox backup data and attempted to transfer it to cloud storage. Microsoft says the available evidence does not confirm that transfer succeeded. Do not confuse activity on observed hosts with evidence that every Zimbra deployment was compromised.
Which version to install
Version 10.1.20 fixes CVE-2026-73570; earlier versions should be treated as vulnerable when the configuration prerequisites are met. Zimbra later released 10.1.21, which fixes additional security issues. Follow the vendor instructions for your branch and confirm the version on every node after upgrading.
If you cannot upgrade immediately, CERT Polska recommends checking the SNMP configuration and looking for exploitation traces; temporary measures do not replace installing the fix.
Indicators to investigate
Preserve logs before cleanup. CERT Polska flags abnormal service-state entries in /var/log/zimbra.log. Microsoft also recommends checking for unexpected JSP files and permission changes in application directories such as /opt/zimbra/jetty/webapps/ and /opt/zimbra/jetty_base/webapps/, as well as unknown system services or scheduled tasks.
A patch blocks the known exploit but does not remove persistence already installed. If you find signs of compromise, isolate the server under your incident procedure and examine evidence before deleting files or rebuilding the system.
Accounts and secrets after investigation
If compromise is confirmed or cannot be ruled out, inventory accounts, authentication secrets, service keys and data that Zimbra processes could access. Microsoft reports collection of local credentials and mailbox data. Plan revocation or replacement after preserving evidence, then check the systems that rely on those secrets.
To reduce scattered copies during this work, read the team password-sharing guide.
How Soclyde fits
Soclyde does not patch Zimbra or detect a server intrusion. It can help store administration, relay and backup access in a local-first encrypted vault with separate secrets for each use, and organize their authorized sharing.
This can help organize credential rotation after investigation without replacing the patch, logs or incident response. To create replacement passwords, read the secure password generator guide; the password manager security audit guide can help structure an access review.
The takeaway
CVE-2026-73570 has been fixed since Zimbra 10.1.20; apply the fix to every node. Patch, search for persistence and assess secrets accessible to a compromised server. Version 10.1.21 also fixes later vulnerabilities. For questions about Soclyde, contact the team.
