CVE-2026-73570

Exploited in the wild. In CISA KEV since 2026‑08‑21. Fixed in 10.1.20.

CVSS 3.18.9High EPSS percentile99th72% chance in 30 days CISA KEVListedsince 2026-08-21, due 2026-08-24
No public exploit known Fix10.1.20Upgrade to this build

Published 2026-08-13Updated 2026-08-24Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Zimbra CollaborationAffected: < 10.1.20Upgrade to: 10.1.20Stated by: CVE record
Synacor Zimbra Collaboration SuiteAffected: < 10.1.20Upgrade to: 10.1.20Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your Zimbra server is running Collaboration (ZCS) older than 10.1.20, and whether the optional zimbra-snmp package is installed.
Verify whether SNMP notifications are enabled in your Zimbra/SNMP configuration.
If both are true, plan to upgrade Collaboration to fixed version 10.1.20 (or later) using Zimbra’s official security guidance.
If you cannot upgrade immediately, disable SNMP notifications and/or remove the zimbra-snmp package per vendor instructions, then confirm the change took effect.
Document the date/time of the change and monitor for suspicious activity on the Zimbra host until the update is completed.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

6 publishers

Microsoft reported that attackers exploited Zimbra's CVE-2026-73570 command injection vulnerability in the wild between patch release and public disclosure, deploying webshells and persisting via systemd.
as reported · Oct 1, 2026·SecurityWeek summary
Added to CISA KEV catalog
Aug 21, 2026·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 2 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

In plain language

Written by AI from the record

If you run Zimbra Collaboration and have the optional zimbra-snmp package installed with SNMP notifications turned on, you should treat CVE-2026-73570 as an urgent remote takeover risk and update to 10.1.20 or later immediately.

CVE-2026-73570 is a remote code execution flaw in Zimbra Collaboration via SNMP notification processing: improper sanitization of untrusted input can let an unauthenticated attacker trigger arbitrary OS command execution as the Zimbra user when zimbra-snmp is installed and SNMP notifications are enabled; it is listed in CISA KEV with an action deadline of 2026-08-24.

If you're affected

Full server takeover
Malware installation risk
Customer email data compromise
Service outage and disruption

What is it

This is a weakness in Zimbra that can allow an attacker on the network to trick the system into running commands on the server. The risk is much higher if you installed the optional SNMP add-on and turned on SNMP notifications, because the notification handling process can be abused. Think of it like a door in your building that’s usually for delivery updates—but if configured a certain way, a bad actor can use it to unlock the back office computer and run their own commands.

Who is affected

This matters if you run Zimbra Collaboration (ZCS) and your deployment includes the optional zimbra-snmp package with SNMP notifications enabled, and your version is before 10.1.20. It is specifically a remote risk tied to how SNMP notifications are processed, so exposure depends on your configuration and whether the attacker can reach the relevant interface. If SNMP notifications aren’t enabled or zimbra-snmp isn’t installed, the scenario described in the advisory does not apply; otherwise, treat it as an internet-facing risk if your Zimbra services are reachable from outside your network.

How urgent is it

This is RED because it is confirmed by CISA to be exploited in the real world (CVE-2026-73570 is listed in KEV). CISA requires remediation by 2026-08-24, and the vulnerability can allow remote attackers to execute commands on the Zimbra server when the SNMP add-on and notifications are enabled.

What to do — in detail

Confirm exposure (owner/IT checklist)

Identify the running product/version: confirm you are running “Collaboration” / “Zimbra Collaboration Suite” and note whether it is before 10.1.20.
Confirm zimbra-snmp presence: check whether the optional zimbra-snmp package is installed on the Zimbra host.
Confirm SNMP notifications are enabled: review your Zimbra/SNMP settings to determine whether SNMP notifications are turned on (the vulnerability requires both zimbra-snmp and SNMP notifications).
Confirm reachability: determine whether your Zimbra services handling this behavior are reachable from the internet or untrusted networks.

Patch / upgrade (primary fix)

Upgrade Collaboration to the vendor fixed release: 10.1.20.
Treat 10.1.20 as the minimum fixed version; if you already run a later release, verify you are on/above 10.1.20.

Temporary mitigation if patching is delayed

Disable SNMP notifications and/or remove/disable the optional zimbra-snmp package according to Zimbra’s security instructions.
After the change, re-check that SNMP notifications are actually off and that zimbra-snmp is no longer active.

CISA timing

CISA KEV remediation due date: 2026-08-24.

What to monitor during/after remediation

Review Zimbra server logs around the period of exposure for unexpected process execution, unusual command activity, and abnormal email/SNMP-related events.
Watch for persistence behavior (new scheduled tasks, unexpected binaries/scripts) on the Zimbra host, especially if SNMP notifications are enabled until the upgrade is complete.
If there are any indicators of compromise, escalate to incident response immediately and preserve logs for triage.

Technical context

CVE-2026-73570 is a remote code execution vulnerability (CWE-78) in Zimbra Collaboration (ZCS) affecting versions before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. The mechanism is improper sanitization of untrusted input during SNMP notification processing, which can allow an unauthenticated attacker to trigger execution of arbitrary operating system commands as the Zimbra user.

Exploitation status: CISA KEV lists this CVE as exploited in the wild (added 2026-08-21) with a remediation due date of 2026-08-24, and the traffic-light verdict is RED. No public exploit code was found in the provided sources, and EPSS is reported as a low predicted likelihood with a flat trend; however, KEV/real-world exploitation takes precedence for urgency. KEV meaning here: it indicates CISA has high confidence exploitation is occurring and mandates action aligned with CISA’s prioritization/triage and forensics guidance.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2026-08-21.

US federal agencies must remediate by 2026-08-24.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

72% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

21 events over 80 days, from the signal feeds we watch.

2026-10-11EPSS band changemoderate → highepss band change
2026-08-31EPSS band changelow → moderate
2026-08-27EPSS band change0 → moderateepss band change
2026-08-26Nuclei check added
2026-08-24Analysis publishedZimbra's Optional SNMP Package Turned Into an Unauthenticated RCE — and CERT Polska Caught It Exploitedpatch available, record updated
2026-08-22Patch availablerecord updated

Affected products

Zimbracommercialaka zimbra collaboration server
- CollaborationDesktop AppOn-premEnterprise Software / collaboration-groupware
synacorcommercial · US
- zimbra collaboration suiteWeb AppOn-premCommunications / email-server-client

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Scored 8.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability LowReduced performance or intermittent disruption of service