What’s Vulnerable › Vulnerabilities

CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

• Severity: high (CVSS 8.9 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-08-21
• EPSS: 71.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-13 · updated 2026-08-24
• Weakness: CWE-78

Description

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Summary

Zimbra Collaboration Suite (ZCS) before 10.1.20 contains an OS command injection flaw that allows unauthenticated remote code execution when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Crafted SMTP requests can execute arbitrary commands as the Zimbra user, and the issue is rated CVSS 8.9. CISA lists it as actively exploited with a public exploit available and a 71.7% EPSS probability of exploitation in 30 days. Upgrade to ZCS 10.1.20 or later, and if patching is not immediately possible, disable SNMP notifications or remove the zimbra-snmp package as a mitigation.

تحتوي Zimbra Collaboration Suite (ZCS) قبل الإصدار 10.1.20 على ثغرة حقن أوامر في نظام التشغيل تتيح تنفيذ تعليمات برمجية عن بُعد دون مصادقة عند تثبيت حزمة zimbra-snmp الاختيارية وتفعيل إشعارات SNMP. ويمكن لطلبات SMTP المُعدّة خصيصاً تنفيذ أوامر عشوائية بصلاحيات مستخدم Zimbra، وقد صُنّفت الثغرة بدرجة 8.9 على مقياس CVSS. تُدرجها CISA ضمن الثغرات المستغلة فعلياً، مع وجود استغلال عام واحتمال استغلال بنسبة 71.7% خلال 30 يوماً وفق EPSS. يجب الترقية إلى ZCS 10.1.20 أو أحدث، وإذا تعذّر الترقية الفوري فيُنصح بتعطيل إشعارات SNMP أو إزالة حزمة zimbra-snmp كإجراء تخفيف.

Affected products

• Zimbra Collaboration: before 10.1.20 — fixed in 10.1.20

How to fix

Upgrade to a fixed version: Zimbra Collaboration 10.1.20. Check the vendor advisory for mitigations.

References

• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570

Get alerted when CVE-2026-73570 or the next vulnerability affects your stack