A critical vulnerability, CVE-2026-73570, affecting Zimbra Collaboration versions prior to 10.1.20 has been actively exploited, according to CERT Polska. The flaw has a CVSS score of 8.9 and allows unauthenticated remote code execution (RCE) due to improper handling of SNMP notifications. Attackers can execute arbitrary OS commands as the zimbra user, which poses significant risks as they can install web shells and access emails without needing credentials.
To mitigate this threat, users should upgrade to version 10.1.20 immediately. Signs of compromise may include unusual log entries and files created by the zimbra user in certain directories. Patch and review relevant security advisories as necessary.