Poland's CERT warns of active attacks on critical Zimbra email flaw

Key points

• CERT Polska, Poland's national cyber incident team, reported on Monday that attackers are actively exploiting a critical flaw in Zimbra Collaboration Suite, a widely used business email platform.
• The bug, CVE-2026-73570, lets an unauthenticated attacker run commands on the server through the software's SNMP monitoring feature.
• Zimbra released a fix in version 10.1.20 on 20 July 2025.
• Internet scanning group Shadowserver counts more than 12,100 Zimbra servers reachable from the public internet, most of them in Europe and Asia.
• Admins are being told to check for unexpected service restarts and suspicious files written by the zimbra user in the last 30 days.

Poland's national cyber response team has flagged a serious flaw in Zimbra Collaboration Suite as under active attack. The software is used by governments, universities and thousands of companies to run their email and shared calendars.

The warning came in a Monday advisory from CERT Polska, first reported by BleepingComputer. It describes an operating system command injection bug: a weakness that lets an outsider trick the server into running commands as if they were a system administrator.

What is the flaw?

The bug is tracked as CVE-2026-73570, a critical remote code execution issue in Zimbra's SNMP notification handling. In plain terms, the part of Zimbra that sends out monitoring alerts does not properly clean up input it receives, so a specially built request can smuggle in commands.

Zimbra's own write-up says the attacker does not need to log in. Any server with SNMP notifications switched on and reachable from the internet is a target.

Zimbra shipped a fix in version 10.1.20 on 20 July 2025. Servers still on older builds remain exposed.

Who is at risk?

Organisations running their own Zimbra mail servers. Shadowserver, a non-profit that scans the internet for exposed systems, currently tracks 12,100+ Zimbra servers open to the public internet, with 4,492 in Asia and 4,382 in Europe. Not all are vulnerable, and some may be decoys set up to watch attackers, but the pool of potential victims is large.

Here is the picture at a glance:

What should admins check?

CERT Polska has published concrete indicators. Look for the Zimbra service restarting on its own without a scheduled reason. Review the folders /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ for any files created by the zimbra user in the last 30 days. Unexpected files there can point to a web shell, a small script that gives the attacker a back door.

Patching to 10.1.20 or later is the priority. Where patching has to wait, disabling SNMP notifications removes the attack surface tied to this specific bug.

Why Zimbra keeps coming up

Zimbra servers hold sensitive mail and often sit at the edge of a network, which makes them a favourite target for state-linked spies. In February 2023, Russia-linked Winter Vivern used a reflected cross-site scripting bug to steal mail from NATO-aligned targets. US and UK agencies warned in October 2024 that APT29, also known as Midnight Blizzard, was going after Zimbra servers to grab email credentials. In March, Seqrite Labs reported that APT28, tied to Russian military intelligence, was hitting Ukrainian government Zimbra systems through a stored XSS flaw.

The pattern is clear enough. Unpatched Zimbra tends to get found.

Common questions

Do end users need to do anything?

Not directly. This is a server-side flaw, so the fix is the responsibility of whoever runs your organisation's mail. If you are an admin, patch to 10.1.20 and hunt for the indicators CERT Polska listed.

Is my webmail login enough to trigger this?

No. The bug does not require any login. That is what makes it serious, and why exposed servers should be patched before anything else this week.