https://reddit.com/r/sysadmin/comments/1vzmdo0/cve202673570_zimbra_snmp_rce_abused_to_deploy/: CVE-2026-73570: Zimbra SNMP RCE abused to deploy coin-miner malware

Q: Which Zimbra deployments are exposed?

Zimbra Collaboration Suite deployments running versions before 10.1.20 are affected when SNMP is installed and SNMP notification is enabled. Systems without the vulnerable SNMP/logwatch components installed and enabled are not described as affected.

Q: What does an attacker need to exploit this issue?

An attacker can exploit the issue without authentication by sending a crafted SMTP request. Successful exploitation results in operating-system command execution as the zimbra user rather than root.

Q: What signs could indicate that a server has already been compromised?

Observed activity includes malware written to /dev/shm, cron persistence being added, and a coin miner or backdoor that repeatedly respawns. Investigate these artifacts alongside suspicious SMTP requests and SNMP/logwatch activity.

Q: Is this being exploited in the wild?

Yes. Active exploitation against Zimbra servers has been reported, with observed attacks deploying coin-miner malware and backdoors after command execution.

Published Aug 27, 2026

Updated

Affected Software

1 affected component

Zimbra Zimbra Collaboration Suite (ZCS)<10.1.20

Frequently Asked Questions

Which Zimbra deployments are exposed?

Zimbra Collaboration Suite deployments running versions before 10.1.20 are affected when SNMP is installed and SNMP notification is enabled. Systems without the vulnerable SNMP/logwatch components installed and enabled are not described as affected.

What does an attacker need to exploit this issue?

An attacker can exploit the issue without authentication by sending a crafted SMTP request. Successful exploitation results in operating-system command execution as the zimbra user rather than root.

What signs could indicate that a server has already been compromised?

Observed activity includes malware written to /dev/shm, cron persistence being added, and a coin miner or backdoor that repeatedly respawns. Investigate these artifacts alongside suspicious SMTP requests and SNMP/logwatch activity.

Is this being exploited in the wild?

Yes. Active exploitation against Zimbra servers has been reported, with observed attacks deploying coin-miner malware and backdoors after command execution.