Unauthenticated OS command injection in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. NVD: crafted SMTP requests can run commands as the zimbra user.

CERT Polska reported active exploitation. Patch to 10.1.20.

UPDATE 30 Sep 2026: Microsoft Security Blog publishes tracking/hunting notes for unauthenticated command injection on internet-facing mail servers including this CVE. If you cannot upgrade, remove zimbra-snmp / disable snmp_notify and hunt per CERT Polska.

UPDATE 1 Oct 2026 desk: Microsoft Security Blog (30 Sep) details post-exploitation observed between patch availability (Zimbra 10.1.20, 20 Jul 2026) and public disclosure (13 Aug 2026) — including Jul 28–Aug 7 out-of-band probes via collaborator/OAST domains, JSP web shells across Jetty/mailboxd paths, wget/curl payload fetch, cron/systemd/memfd persistence, mailbox/authentication-data collection, and privilege escalation abusing Zimbra sudo-authorized helpers (zmmailboxdmgr writable log → PAM symlink → pam_exec → passwordless sudo for the zimbra account). THN 30 Sep amplifies the same Microsoft research.

Desk does not reproduce exploit construction. Hunt and contain per Microsoft + CERT Polska; patch remains 10.1.20; if upgrade delayed remove zimbra-snmp / disable snmp_notify.