Zimbra Collaboration Suite Flaw Actively Exploited to Execute Arbitrary Commands

CERT Polska warns of active exploitation of CVE-2026-73570 — an unauthenticated OS command injection in Zimbra Collaboration Suite (affecting environments with snmp_notify enabled and swatchdog running) that permits execution of shell commands as the zimbra user; organizations are urged to upgrade to Zimbra 10.1.20, inspect /var/log/zimbra.log for suspicious service changes, hunt for unexpected files in Jetty and /tmp, isolate compromised hosts, preserve evidence, and rotate credentials.