The tool you installed to watch your mail server just became the way in.
CVE-2026-73570 — CVSS 8.9 — unauthenticated command execution through Zimbra Collaboration's SNMP monitoring function. CERT Polska reported active exploitation on August 17. CISA's federal patch deadline was today, August 24.
WHAT ACTUALLY HAPPENED
Zimbra shipped the fix in version 10.1.20 on July 20. Nobody treated it as urgent — high severity, monitoring component, not a headline RCE.
Then CERT Polska found it being used in the wild. Under the right conditions an unauthenticated attacker reaches the SNMP monitoring path and executes operating system commands as the zimbra user — the account that owns the mail store, the config, and the message queues.
Shadowserver went looking for exploitation artifacts and found more than 270 already-compromised Zimbra instances on the internet.
CISA added it to the KEV catalog and gave federal agencies three days.
WHY MONITORING IS THE SOFT TARGET
SNMP is the protocol nobody re-reviews. It was turned on during deployment, it feeds a dashboard somebody built four years ago, and it sits below the line where patching decisions get argued.
That is exactly why it works as an entry point. Monitoring interfaces are trusted by design, rarely authenticated properly, almost never segmented, and they run as service accounts with real privilege.
And this is a mail server. Compromise here is not just a server — it is every message, every attachment, and every password-reset link that transits it. Zimbra breaches have consistently ended in mailbox theft and 2FA interception, not in ransomware.
A month between patch and exploitation is not a grace period. It is the window attackers use to build the exploit from your vendor's own advisory.
WHAT TO DO NOW
UPGRADE TO 10.1.20 OR LATER — the patch has existed since July 20; there is no defensible reason to still be exposed today.
ASSUME COMPROMISE IF YOU WERE EXPOSED — with 270+ confirmed victims, unpatched internet-facing instances need a hunt, not just a patch: check for webshells in the Zimbra web root and unexpected zimbra-user processes.
CLOSE SNMP AT THE EDGE — monitoring services should answer your NOC subnet, never the public internet.
ROTATE WHAT THE MAIL SERVER TOUCHED — service credentials, API tokens, and any secret that ever sat in a mailbox.
Attackers do not always come through the front door. Sometimes they come through the thing watching the front door.
Do you know, right now, which management protocols on your servers are reachable from outside your network?