Status: KEV | Advisory ID: CVE-2026-73570
| CVE | CVE-2026-73570 |
| CVSS | CVSS 8.9 (High). |
| Affected products | Synacor Zimbra Collaboration Suite (ZCS) and Synacor Zimbra Collaboration Suite |
| Exploitation status | Listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation. |
| Classified as | CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')) |
| KEV listing | Added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-08-21. |
| Exploitation prediction (EPSS) | 32% probability of exploitation in the next 30 days (98% percentile) -- FIRST.org's EPSS model. |
| Federal remediation deadline | 2026-08-24 (CISA KEV, Binding Operational Directive). |
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-73570 |