Critical Zimbra flaw: unauthenticated RCE via SNMP handlers

Zimbra Collaboration Suite is affected by critical vulnerability CVE-2026-73570 (CVSS 8.9) that allows unauthenticated remote code execution through its SNMP notification subsystem. The fix shipped in version 10.1.20 on July 20, 2026, but public disclosure was delayed until August 13, during which attackers scanned and backdoored exposed servers; about 274 instances were compromised and roughly 10,000 remain exposed.

• CVE-2026-73570: CVSS 8.9, unauthenticated RCE via zimbra-snmp and swatchdog
• Fixed in Zimbra 10.1.20 on July 20, disclosed publicly on August 13, 2026
• Shadowserver: ~274 compromised instances, ~10,000 still exposed
• Attackers drop JSP web shells in Jetty and steal LDAP tokens and mail archives