CVE-2026-73570
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Description
CVE-2026-73570 is a high-severity OS command injection vulnerability in Zimbra Collaboration Suite (ZCS) before version 10.1.20. It exists only when the optional zimbra-snmp package is installed and SNMP notifications are enabled: due to improper sanitisation of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that result in execution of arbitrary operating system commands as the Zimbra user. Because Zimbra hosts an organisation's email, calendars and contacts, code execution as the Zimbra user exposes the entire mail store. CVE-2026-73570 carries a CVSS score of 8.9 with a scope change, an EPSS score of roughly 32% at the 98th percentile, and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog with a deadline that has already passed.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| synacor | zimbra collaboration suite | < 10.1.20 |
References
- https://wiki.zimbra.com/wiki/Security_Center(Release Notes)
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories(Vendor Advisory)
- https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS command injection occurs when software constructs all or part of an operating system command from externally influenced input without neutralising the special elements — shell metacharacters such as ;, |, backticks or $() — that change what the command does. In CVE-2026-73570 untrusted content arriving through SMTP reaches Zimbra's SNMP notification processing, where it is incorporated into an operating system command without sanitisation, so attacker-chosen commands execute as the Zimbra user.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2026-73570 is remotely exploitable over the network with no authentication and no user interaction, though attack complexity is High because the vulnerable path depends on the optional zimbra-snmp package being installed and SNMP notifications being enabled, and on the crafted content reaching notification processing. The scope is CHANGED, reflecting that the injected commands execute on the underlying operating system rather than within the mail application's own boundaries, which is why the score reaches 8.9. Confidentiality and integrity impacts are High and availability impact is Low: an attacker gains the Zimbra user's access to the mail store, meaning every mailbox, attachment and archived message on the server, along with configuration and credential material, and can alter mail data or install persistence. The delivery vector deserves emphasis — the attack arrives by SMTP, so it reaches the server the same way ordinary mail does and no administrative interface needs to be exposed. The EPSS score of about 32% in the 98th percentile confirms substantial active exploitation, and CERT Polska has published an advisory on this actively exploited Zimbra vulnerability.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-73570 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 24 August 2026 that has already passed. CERT Polska has published an advisory explicitly describing this as an actively exploited vulnerability in Zimbra Collaboration Suite, corroborating the KEV entry with independent national-CERT reporting. The EPSS score of approximately 32%, in the 98th percentile, is exceptionally high and indicates sustained mass exploitation rather than isolated targeted use. No packaged exploit tool appears among the available references, but Zimbra has a long history of rapid weaponisation — its vulnerabilities are routinely folded into automated scanning within days — and the SMTP delivery vector makes automated exploitation particularly easy, since an attacker simply sends mail. Any Zimbra server below 10.1.20 with zimbra-snmp installed should be treated as compromised.
Remediation
- Follow the CISA KEV required action immediately. Apply mitigations in accordance with Zimbra's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 24 August 2026 has passed.
- Upgrade Zimbra Collaboration Suite to 10.1.20 or later. All versions before 10.1.20 are affected; consult the Zimbra Security Center and Zimbra Security Advisories for the release containing the fix and the correct upgrade path from your current version.
- Remove or disable
zimbra-snmpas an immediate mitigation. The vulnerability is only reachable when the optionalzimbra-snmppackage is installed and SNMP notifications are enabled — check whether your deployment actually uses SNMP monitoring, and if not, disabling notifications or removing the package closes the path entirely while the upgrade is scheduled. - Assume compromise and investigate the mail server. Because exploitation arrives over SMTP and executes as the Zimbra user, review mail logs for anomalous messages preceding the patch, inspect the host for web shells in the Zimbra web directories, unfamiliar processes, cron entries and outbound connections, and check for new administrative accounts, forwarding rules and filters that could exfiltrate mail quietly. CERT Polska's advisory on the actively exploited Zimbra vulnerability is a useful reference.
- Rotate credentials and harden command construction long term. Reset Zimbra administrative passwords and rotate LDAP, database and integration credentials held by the server, force user re-authentication where mail data may have been exposed; then follow the general defence for this weakness class — avoid invoking shell commands from application code entirely, and where unavoidable pass arguments as separate array elements through APIs that never interpret shell metacharacters, rather than attempting to escape untrusted input.
Technical Details
CVE-2026-73570 is an OS command injection flaw (CWE-78) in Zimbra Collaboration Suite. When the optional zimbra-snmp package is installed and SNMP notifications are enabled, Zimbra generates notifications from data derived from mail processing. That path fails to sanitise untrusted input before incorporating it into an operating system command, so a specially crafted SMTP request carries content that the shell interprets as command syntax rather than as data, and the resulting commands execute with the privileges of the Zimbra user. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L records the combination precisely: network-reachable and unauthenticated with no user interaction, but High attack complexity because of the conditional package and configuration prerequisites, a changed scope because execution escapes the application into the operating system, high confidentiality and integrity impact and low availability impact. The SMTP delivery path is what makes this practical at scale — an attacker does not need to reach an administrative interface, only to send mail that the server accepts and processes.
Frequently Asked Questions
Is CVE-2026-73570 being actively exploited?
Yes. CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog with a remediation due date of 24 August 2026 that has passed, and CERT Polska has published an advisory describing it as actively exploited. Its EPSS score of about 32% places it in the 98th percentile, indicating widespread exploitation activity.
What products are affected by CVE-2026-73570?
Zimbra Collaboration Suite (ZCS) is affected in all versions before 10.1.20, but only when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Deployments without that package or with SNMP notifications disabled do not expose the vulnerable code path.
How do I fix CVE-2026-73570?
Upgrade Zimbra Collaboration Suite to 10.1.20 or later as documented in the Zimbra Security Center and security advisories. As an immediate mitigation, disable SNMP notifications or remove the zimbra-snmp package if your deployment does not need it, then investigate the server for web shells and unauthorised mail rules and rotate administrative and directory credentials.
How severe is CVE-2026-73570?
CVE-2026-73570 is rated High with a CVSS 3.1 base score of 8.9. It is unauthenticated and network-exploitable with no user interaction and crosses a security scope boundary, yielding arbitrary OS command execution as the Zimbra user with high confidentiality and integrity impact; attack complexity is High because the optional SNMP package must be installed and enabled, but an EPSS score in the 98th percentile and confirmed active exploitation make it urgent for affected deployments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.