The vulnerability is a command-injection flaw that occurs when Zimbra’s SNMP notification system processes untrusted input. An unauthenticated attacker can send crafted SMTP requests via SNMP notifications for the optional zimbra-snmp package, causing the Zimbra server to execute arbitrary operating-system commands as the Zimbra user. This can grant full compromise of the affected system.

Zimbra Collaboration (ZCS) versions prior to 10.1.20 are affected when the optional zimbra‑snmp package is installed and SNMP notifications are enabled. The flaw applies across all installation channels for the Zimbra Collaboration Suite, as reflected in the related CPE entries. Administrators should verify that any impacted installation is updated to 10.1.20 or later, or that the zimbra‑snmp package is removed or disabled.

The CVSS score of 8.9 indicates a high severity vulnerability. The EPSS score is 21%, indicating a relatively high probability of exploitation. The vulnerability is listed in the CISA KEV catalog, demonstrating active exploitation. Because the flaw allows unauthenticated remote exploitation via SNMP notifications, an attacker with network access to the SNMP service can send crafted input that results in arbitrary OS command execution as the Zimbra user.