An unauthenticated attacker can send crafted SMTP requests to Zimbra servers running the optional zimbra-snmp package with notifications enabled, triggering OS command execution as the Zimbra user.