Swiss SME Cyber Alert: Zimbra mail servers – actively exploited flaw allows attacks by email
An actively exploited vulnerability in Zimbra Collaboration Suite allows attackers to use specially crafted emails against mail servers. The vulnerable configuration requires the optional zimbra-snmp package and SNMP notifications to be enabled; no login or user interaction is needed.
If your organisation runs Zimbra directly or through an IT provider, ask for an immediate version check and a review for signs of compromise.
What happened?
On 30 September 2026, Microsoft Threat Intelligence published details of confirmed exploitation of CVE-2026-73570. In the affected configuration, a crafted email can execute commands with the privileges of the Zimbra service account.
Investigated incidents included web shells, remote access, privilege escalation, and access to email and authentication data. Zimbra had already fixed the underlying vulnerability in version 10.1.20.
Could my organisation be affected?
Organisations may be affected if they use Zimbra Collaboration Suite as an in-house mail server or receive it as a managed service. Systems earlier than version 10.1.20 require particular attention when zimbra-snmp is installed and SNMP notifications are enabled.
Microsoft 365, Exchange Online, and Google Workspace are not affected by this Zimbra vulnerability. Your IT provider can confirm which mail platform is actually used for your business email.
What should you do now?
Ask your IT provider to carry out a prompt review today. The task should cover more than patching: because exploitation has already occurred, the server also needs to be checked for signs of an earlier compromise.
Confirm whether Zimbra Collaboration Suite is in use and record the installed version.
Upgrade to a current supported release; remediation for CVE-2026-73570 must include the fix introduced in Zimbra 10.1.20.
Check whether zimbra-snmp is installed and SNMP notifications are enabled.
Review logs, web directories, remote-access activity, persistence, and affected credentials using Microsoft's guidance.
How urgent is it?
Urgency: high. Exploitation is confirmed, and an attack requires neither authentication nor employee interaction. Potentially affected systems should be reviewed immediately; applying the update does not by itself rule out an earlier compromise.
Information for your IT provider
CVE: CVE-2026-73570.
Attack path: specially crafted SMTP message reaching the SNMP notification process.
Required conditions: zimbra-snmp installed and SNMP notifications enabled.
Remediation: Zimbra Collaboration Suite 10.1.20 or later; use the latest supported release where possible.
If immediate patching is impossible, assess Microsoft's interim mitigations and their impact on mail delivery before applying them.
Hunt for compromise from late July 2026 using Microsoft's indicators and behavioural patterns.
