CVE-2026-73570

HIGHCVSS 8.9Known Exploited

CISA Known Exploited Vulnerability

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-73570

Remediation deadline: August 24, 2026

Description

Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Timeline

Published:August 13th, 2026 4:19 PM

Last modified:August 24th, 2026 1:19 PM

Added to KEV:August 21st, 2026

CVSS Scoring

CVSS v3: 8.9 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Affected Software

From NVD CPE configuration data

Vendors

synacor

Products

zimbra_collaboration_suite

Weaknesses (CWE)

CWE-78

References & Reports

Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute