CERT Polska’s message on Monday was short and unglamorous: attackers are now exploiting CVE-2026-73570 in the wild. Not “may be.” Not “proof-of-concept observed.” Actively exploiting. The Polish CERT team, which spends its days watching the kind of infrastructure most of us never think about, saw real traffic hitting real mail servers.
My first reaction was not surprise. It was recognition. The patch landed on July 20 in Zimbra Collaboration Suite 10.1.20. The exploitation warning came a month later. That gap is the whole story, and it’s the same story every time.
What the flaw actually is
CVE-2026-73570 is a command injection weakness in Zimbra’s SNMP monitoring component. If SNMP notifications are enabled, an unauthenticated attacker can get remote code execution. No credentials. No phishing. No social engineering. Just a request to the part of your mail server that exists to tell you the mail server is healthy.
Sit with that irony for a second. The monitoring component — the thing whose entire job is to report on the system’s wellbeing — became the way in. The watchman’s door was unlocked.
And once you have RCE on a mail server, you have the mail. Every thread, every attachment, every password reset link, every contract draft someone sent at 11pm. Email remains the single richest target in most organizations because it is the index of everything else.
Why I’m writing about this on an AI tools site
Because of what we’ve all been doing for the past two years.
Every AI agent product I review wants access to your inbox. Email triage agents. Meeting-prep agents that read your threads before a call. Sales agents that draft follow-ups. Support agents that watch a shared mailbox. Research agents that pull context from your correspondence. Mail access is the default ask, and it’s granted fast, because the demos are genuinely good.
The vendor pitch is always about the model. The benchmark scores, the reasoning traces, the orchestration graph. What almost nobody in the agent space wants to talk about is the plumbing underneath — the mail server itself, the monitoring daemon attached to it, the version number that hasn’t moved since someone set it up.
An agent reading a compromised mailbox is not a smart agent. It’s a very fast, very obedient data pipeline pointed at stolen material. And if the mailbox is compromised, your agent’s outputs are now downstream of an attacker. Prompt injection via email content stops being a theoretical research paper and becomes a feature of the environment.
The uncomfortable math
There’s a detail in the reporting that I keep returning to: there is no information on how many instances have been compromised. We don’t know whether the hits CERT Polska observed were honeypots, already-patched servers, or production systems full of real correspondence. That ambiguity is normal for early-stage exploitation reporting, and it’s also exactly the condition under which people decide to wait and see.
Don’t wait and see. The asymmetry is brutal:
- Patching to 10.1.20 is a maintenance window.
- Being wrong about whether you were hit is a breach notification, a legal review, and years of your email in someone else’s hands.
If you run ZCS, the triage list is short. Check your version. Check whether SNMP notifications are enabled, because that’s the condition the exploit depends on. Patch. Then go look at logs from before July 20, not after, because the window opened the moment the bug existed, not the moment someone wrote about it.
What this should change about how you evaluate agents
I review AI tools for a living, and I’m adjusting my own checklist because of stories like this one.
When an agent product asks for mailbox access, the questions that matter are not about model quality. They’re about scope and blast radius. Does it need full-mailbox read, or can it work on a single folder or label? Does it store copies of your mail, and where? Can you revoke access in one click and verify it took effect? Does it log what it read? If your mail server turns out to have been compromised for a month, how much of that exposure did the agent widen?
Vendors rarely answer these clearly, because clear answers are constraints and constraints make demos less impressive. That’s a reason to ask harder, not softer.
Zimbra did its part here. A fix shipped on July 20. The failure mode now sits with operators, and the attackers are counting on that — they always have. The AI tooling layered on top of email doesn’t change that calculus. It just raises the value of what’s behind the door, and the number of things holding a key to it.
Patch the mail server. Then go read the permission scopes on whatever agent you connected to it last month.
🕒 Published: