Active Exploitation of Zimbra Flaw Triggers Federal Patch Deadline

Poland’s national cybersecurity agency has confirmed that threat actors are actively exploiting a critical, recently patched vulnerability in the Zimbra Collaboration Suite software, prompting orders for U.S. federal agencies to secure their systems. The warning, issued by CERT Polska on August 21, 2026, concerns a high-severity flaw identified as CVE-2026-73570, which allows unauthenticated attackers to remotely execute code on affected servers.

The vulnerability enables a remote attacker to inject and execute arbitrary operating system commands with the privileges of the Zimbra user. It is exploitable when the optional zimbrasnmp package is installed and SNMP trap notifications are enabled. A technical root cause is a sanitization failure in the SNMP monitoring component, while a related service, swatchdog, which processes these notifications, is running by default on most installations.

The flaw was patched by Zimbra in version 10.1.20, released on July 20, 2026. According to CERT Polska’s advisory, active exploitation of the vulnerability was confirmed the week of its publication, less than a month after the fix became available. The agency has provided indicators of...