Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

CERT Polska reports active exploitation of CVE-2026-73570, a Zimbra Collaboration command-injection vulnerability (CVSS 8.9) that can yield unauthenticated remote code execution when zimbra-snmp and SNMP notifications are enabled; Zimbra released a patch in version 10.1.20 and administrators are advised to check zimbra logs and recent files in /opt/zimbra/jetty/webapps/* and /opt/zimbra/jetty_base/webapps/*/tmp/ for signs of compromise. The bulletin also contextualizes the threat by referencing recent Zimbra-targeting campaigns attributed to the Russia-linked Laundry Bear group that weaponized a prior Zimbra vulnerability.