CVE-2026-73570

This is a weakness in Zimbra that can allow an attacker on the network to trick the system into running commands on the server. The risk is much higher if you installed the optional SNMP add-on and turned on SNMP notifications, because the notification handling process can be abused. Think of it like a door in your building that’s usually for delivery updates—but if configured a certain way, a bad actor can use it to unlock the back office computer and run their own commands.

This matters if you run Zimbra Collaboration (ZCS) and your deployment includes the optional zimbra-snmp package with SNMP notifications enabled, and your version is before 10.1.20. It is specifically a remote risk tied to how SNMP notifications are processed, so exposure depends on your configuration and whether the attacker can reach the relevant interface. If SNMP notifications aren’t enabled or zimbra-snmp isn’t installed, the scenario described in the advisory does not apply; otherwise, treat it as an internet-facing risk if your Zimbra services are reachable from outside your network.

This is RED because it is confirmed by CISA to be exploited in the real world (CVE-2026-73570 is listed in KEV). CISA requires remediation by 2026-08-24, and the vulnerability can allow remote attackers to execute commands on the Zimbra server when the SNMP add-on and notifications are enabled.