CISA added CVE-2026-73570 to the Known Exploited Vulnerabilities catalog on 2026-08-21, confirming active exploitation of an unauthenticated OS command injection flaw in Zimbra Collaboration Suite that yields arbitrary code execution as the Zimbra user.
What Is It
A remote code execution vulnerability (CWE-78, OS command injection) exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Untrusted input is improperly sanitized during SNMP notification processing, allowing an unauthenticated attacker to send specially crafted SNMP notification traffic that results in execution of arbitrary operating system commands as the Zimbra user.
The CVE carries a CVSS 3.1 base score of 8.9 (HIGH), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L. Attack complexity is rated HIGH, but no privileges and no user interaction are required, and scope is CHANGED.
Why It Matters
CISA's SSVC assessment marks exploitation as active with total technical impact, though it is not currently automatable. The KEV entry lists known ransomware campaign use as "Unknown." Mail infrastructure is a high-value target: code execution as the Zimbra user places an attacker directly on the host processing organizational email, and the CHANGED scope indicates impact beyond the vulnerable component. CERT Polska has also published an advisory on active exploitation of this flaw.
What's Vulnerable
- Zimbra Collaboration Suite (Synacor), all versions before 10.1.20
- CPE:
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*(versionEndExcluding 10.1.20) - Exploitation requires the optional
zimbra-snmppackage to be installed with SNMP notifications enabled
Patch Status
Fixed in ZCS 10.1.20. CISA's required action, due 2026-08-24, is to apply mitigations per vendor instructions in compliance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Where patching is not immediately possible, removing the optional zimbra-snmp package or disabling SNMP notifications should remove the specific attack path described in the advisory, though this has not been independently confirmed as a complete mitigation and does not address any other exposure on an unpatched host; upgrading to 10.1.20 remains the authoritative fix. Stakeholders are responsible for evaluating each asset's internet exposure and adhering to BOD 26-04 patching guidelines.
Sources
- CISA KEV Catalog; CVE-2026-73570
- NVD, CVE-2026-73570
- Zimbra Security Advisories
- Zimbra Security Center
- Zimbra Blog; Patch Release Update: Zimbra 10.1.20
- CERT Polska; Aktywnie wykorzystywana podatność w Zimbra Collaboration Suite
- CISA BOD 26-04
- CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements