CVE-2026-73570

Description

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Scoring

• CVSS: 8.9 (HIGH, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2026-08-21
• Remediation due date: 2026-08-24
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-78

References

• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570

More from Synacor

• CVE-2025-48700 — Zimbra Collaboration Suite (ZCS)
• CVE-2025-66376 — Zimbra Collaboration Suite (ZCS)
• CVE-2020-7796 — Zimbra Collaboration Suite
• CVE-2025-68645 — Zimbra Collaboration Suite (ZCS)
• CVE-2025-27915 — Zimbra Collaboration Suite (ZCS)