Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

A critical command injection vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite is being actively exploited, allowing unauthenticated attackers to execute arbitrary OS commands on affected servers. The flaw is triggered specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled — meaning unnecessary or unreviewed optional components directly expanded the attack surface. This highlights the danger of leaving non-essential services and packages enabled in production environments without a formal review process. Because Zimbra is widely used for enterprise email, a successful exploit can lead to full server compromise, data exfiltration, and lateral movement across the network. Timely patching and strict configuration hygiene are essential to prevent exploitation of publicly disclosed vulnerabilities.