CVE-2026-73570

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-73570 8.9

Synacor · Zimbra Collaboration Suite (ZCS) · Added 2026-08-21 · Published 2026-08-13

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityZimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

VendorSynacor

ProductZimbra Collaboration Suite (ZCS)

Date added2026-08-21

Due date2026-08-24

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-78

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Descriptions

KEV: Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

NVD: A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-22 10:43 UTC

Wall time0.4s

Searches5

Component defaultno

Sources https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/
https://www.bleepingcomputer.com/news/security/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks/
https://www.penligent.ai/hackinglabs/zimbra/
https://github.com/HORKimhab/CVE-2026-73570
https://github.com/advisories/GHSA-jqh7-pchh-v74j
https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/

Hunting hypothesis agent

Hunt access logs for GET requests to /service/extension/backup/snmptrap where snmp_notify contains shell metacharacters like "<ip>; <cmd> #", and check /var/log/zimbra.log for "Service status change" entries with injected command output.

Research details

Componentzimbra-snmp SNMP notification handler (swatchdog snmptrap script at /service/extension/backup/snmptrap)

PreconditionsThe optional zimbra-snmp package must be installed and SNMP notifications must be explicitly enabled in ZCS configuration. The attacker needs no authentication but must be able to deliver crafted HTTP requests to the Zimbra backup extension endpoint, which is typically internet-reachable on port 443 or 7071. Affected versions are Zimbra Collaboration Suite prior to 10.1.20. agent

DeliveryHTTP request to /service/extension/backup/snmptrap endpoint

Public PoCyes

PoC URLs https://github.com/HORKimhab/CVE-2026-73570 Third-party repos; verify before use.

Advisoryhttps://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/

Exploit notesCVSS attack complexity: HIGH. The vulnerability requires the optional zimbra-snmp package to be installed and SNMP notifications to be enabled, which is not the default configuration. However, once the preconditions are met, exploitation is unauthenticated via the HTTP backup extension endpoint. Public PoC sends GET requests to /service/extension/backup/snmptrap with command injection in the snmp_notify parameter.

SummaryZimbra Collaboration Suite (ZCS) before 10.1.20 contains an OS command injection (CWE-78) in the SNMP notification processing pipeline. When the optional zimbra-snmp package is installed and SNMP notifications are enabled, an unauthenticated attacker can send crafted HTTP requests to the /service/extension/backup/snmptrap endpoint that inject shell commands via the snmp_notify parameter (e.g., '127.0.0.1; <command> #'), causing the swatchdog service to execute arbitrary commands as the zimbra user. CERT Polska confirmed active exploitation as of August 17, 2026; Shadowserver tracks over 12,100 internet-exposed Zimbra servers. Patch to ZCS 10.1.20 or later, or disable SNMP notifications and uninstall the zimbra-snmp package.

Tia coverage

First reported2026-07-20

First exploit report2026-08-20

Exploit report → KEV1 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

critical-zimbra-rce-flaw-now-actively-exploited-in-attacks when-business-email-compromise-starts-rewriting-reality

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.