CVE-2026-73570

HIGH(8.9)KEVErhöhtes Risiko

Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

Beschreibung

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

KEV-Informationen

Hersteller
Synacor
Produkt
Zimbra Collaboration Suite (ZCS)
Hinzugefügt am
21. August 2026
Fälligkeitsdatum
24. August 2026
Erforderliche Maßnahme
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVSS-Score

Vektorstring
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:LIm Rechner öffnen
Angriffsvektor
NETWORK
Angriffskomplexität
HIGH
Erforderliche Privilegien
NONE
Benutzerinteraktion
NONE
Scope
CHANGED
Vertraulichkeitsauswirkung
HIGH
Integritätsauswirkung
HIGH
Verfügbarkeitsauswirkung
LOW
Ausnutzbarkeitsscore
2.2
Auswirkungsscore
6.0

CWEs

CWE-78OS Command Injection

Improper Neutralization of Special Elements used in an OS Command

Betroffene Produkte

HerstellerProduktVersion
synacorzimbra collaboration suite< 10.1.20

Referenzen

CVSS-Score

8.9
HIGH(8.9)

EPSS-Score

EPSS-Score32.38%
EPSS-Perzentil98.2%

Daten

Veröffentlicht13. August 2026
Zuletzt geändert24. August 2026
StatusAnalyzed
CVSS-Versionv3.1

Quick Links

Zurück zur CVE-Datenbank

Hilfe beim Schwachstellenmanagement?

Unsere Sicherheitsexperten helfen Ihnen bei der Priorisierung und Behebung von Schwachstellen.

Kontakt aufnehmen