Zimbra Collaboration CVE-2026-73570

Exploitation requires two non-default deployment conditions to be simultaneously present: (1) the optional zimbra-snmp package must be explicitly installed - it is not part of a standard Zimbra installation and requires deliberate administrative action to deploy - and (2) SNMP notifications must be enabled in the Zimbra configuration. Without both conditions, the vulnerable code path does not exist and the system is not affected regardless of Zimbra version. The CVSS PR:N confirms no authentication is required once these conditions are met, and UI:N confirms no victim interaction is needed. The AC:H metric indicates additional precision is required in the SMTP payload to successfully trigger SNMP notification processing in a way that enables command injection. Exploitation is further constrained to commands executing as the zimbra OS user rather than root, limiting but not eliminating post-exploitation impact.

The CVSS 8.9 High score reflects a network-accessible, scope-changing command injection requiring no authentication or user interaction - strong signals of high exploitability if the deployment conditions are met. However, AC:H indicates elevated attack complexity, and both the zimbra-snmp package installation and SNMP notification enablement are non-default, explicitly optional configurations that substantially narrow the realistic attack surface compared to what the raw score implies. EPSS data is absent from the available intelligence, so exploitation probability cannot be independently quantified beyond CVSS signal. No CISA KEV listing and no public proof-of-concept exploit were identified at time of analysis, meaning active exploitation remains unconfirmed. Organizations running Zimbra with SNMP monitoring enabled - more common in larger or operationally mature deployments - should treat this as high priority patching, while those without the zimbra-snmp package face no exposure from this CVE whatsoever. The S:C metric warrants additional attention, as successful OS command execution as the zimbra user could enable lateral movement or privilege escalation depending on host-level configuration and co-located services.

An unauthenticated attacker with network access to the Zimbra server's SMTP port sends a specially crafted SMTP request containing OS command metacharacters embedded in fields that flow into SNMP notification processing. When Zimbra processes the SMTP transaction and generates an SNMP notification, the unsanitized attacker-controlled input is passed to a shell command, executing arbitrary OS commands as the zimbra user. No public proof-of-concept has been identified at time of analysis, and the AC:H rating indicates the attacker must precisely craft the payload to trigger the vulnerable SNMP notification code path.