Hackers Target Zimbra Servers in Active Exploitation Campaign

A recently patched Zimbra Collaboration vulnerability is being exploited in the wild, according to Poland’s CERT Polska.

The security hole is tracked as CVE-2026-73570 and it was patched by the developers of the enterprise email server and collaborative software suite with the release of version 10.1.20, announced on July 20.

The high-severity flaw exists when the optional ‘zimbra-snmp’ package is installed and SNMP notifications are enabled.

An attacker can exploit the vulnerability without authentication to execute arbitrary OS commands as the Zimbra user.

The Polish CERT announced seeing attacks this week but did not share any details about the active exploitation campaign. It did, however, share some indicators of compromise (IoCs).