CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Aug 21, 2026
- US federal agencies must remediate it by Aug 24, 2026 (BOD 22-01)
- First attack observed 3 days after disclosure
- Confirmed by sensors, not only by reports
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Oct 2, 2026 Sep 30, 2026 Sep 8, 2026 Sep 6, 2026 Sep 2, 2026 Sep 1, 2026
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:LAffected products
| Vendors | Product | Versions |
|---|---|---|
| synacor | zimbra collaboration suite | < 10.1.20 |
Related articles
An ownCloud flaw allowed theft of Philippine nuclear data: CISA adds it to KEV
On August 27, 2026, CISA added three new vulnerabilities to the Known Exploited Vulnerabilities KEV catalog. The most severe is CVE-2023-49105, an
ZBT: Two New Factory Implants in Chinese Routers Expose Remote Root Access
On August 28, 2026, The Hacker News confirmed through the IEEE registered MAC prefix database that the blocks 78:A3:51 and F8:5E:3C belong to Shenzhen
Gitea Under Attack: Critical RCE Exploited for Cryptojacking, CISA Mandates Patch by August 28
Critical RCE in Gitea (CVE-2026-60004) is being exploited for cryptojacking. CISA requires federal agencies to patch by August 28, 2026.
Oracle CVE-2026-21962 enters KEV: maximum score and unauthorized access to WebLogic
CISA adds Oracle CVE-2026-21962 to KEV catalog. Critical CVSS 10.0 flaw allows unauthorized WebLogic access. Remediation due Aug 27, 2026.
Zimbra Under Attack: Command Injection Exploited in the Wild, CISA Mandates Patch
CISA mandates patch for critical Zimbra command injection vulnerability CVE-2026-73570 exploited in the wild. Update to version 10.1.20 immediately.
Zimbra CVE-2026-73570 Exploited in the Wild: Who Needs to Patch Immediately
CVE-2026-73570 in Zimbra Collaboration is actively exploited. Learn who needs to patch immediately, the vulnerability details, and security steps.
Zimbra Vulnerability Exploited to Enable Unauthenticated Remote Command Execution
Active exploitation of CVE-2026-73570 in Zimbra allows unauthenticated RCE. Affects versions before 10.1.20 with SNMP enabled. Upgrade to 10.1.20 or later for fix.
This product uses the NVD API but is not endorsed or certified by the NVD.