CVE-2026-73570
published 2026-08-13CVE-2026-73570: A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP…
PriorityP197high8.9CVSS 3.1
AVNACHPRNUINSCCHIHAL
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-08-24
Exploited in the wild
EPSS
71.66%
99.4th percentile
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| synacor | zimbra_collaboration_suite | < 10.1.20 | 10.1.20 |
| zimbra | collaboration | < 10.1.20 | 10.1.20 |
CVSS provenance
nvdv3.18.9HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
vulncheck8.9HIGH
cisa8.9HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Zimbra Collaboration up to 10.1.19 Notification code injection (WID-SEC-2026-2429)
vuldb·2026-08-16·CVSS 8.9
CVE-2026-73570 [HIGH] Zimbra Collaboration up to 10.1.19 Notification code injection (WID-SEC-2026-2429)
A vulnerability, which was classified as critical, was found in Zimbra Collaboration up to 10.1.19. The impacted element is an unknown function of the component Notification. Such manipulation leads to code injection.
This vulnerability is traded as CVE-2026-73570. The attack may be launched remotely. There is no exploit available.
You should upgrade the affected component.
GHSA
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
ghsa_unreviewed·2026-08-13
CVE-2026-73570 [HIGH] CWE-78 A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
VulnCheck
Zimbra collaboration Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2026·CVSS 8.9
CVE-2026-73570 [HIGH] Zimbra collaboration Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Zimbra collaboration Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Affected: Zimbra collaboration
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://moje.cert.pl/komunikaty/2026/145/aktywnie-wyk
CISA
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
cisa·2026-08-21·CVSS 8.9
CVE-2026-73570 [HIGH] CWE-78 Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Vulnerability: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Affected: Synacor Zimbra Collaboration Suite (ZCS)
Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for eva
Nuclei
Zimbra Collaboration Suite < 10.1.20 - OS Command Injection
nuclei·CVSS 8.9
CVE-2026-73570 [HIGH] Zimbra Collaboration Suite < 10.1.20 - OS Command Injection
Zimbra Collaboration Suite \r\n"
read: 512
- data: "RCPT TO:\r\n"
read: 512
- data: "QUIT\r\n"
read: 64
matchers:
- type: word
part: interactsh_protocol
words:
- "dns"
# digest: 4b0a00483046022100ddb75fcf997f47104be91234edff5245910b247f39b7812cd6f0170177bfe8b0022100bfbf27cd085d3c87eac81eb10b3f57fc8206a19e9ae719d551dd6fee1afbe41c:922c64590222798bb761d5b6d8e72950
Microsoft
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
blogs_microsoft·2026-10-14·CVSS 8.9
CVE-2026-73570 [HIGH] The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
## Microsoft Threat Intelligence
## Microsoft Digital Crimes Unit
## Post-quantum authentication: Why organizations should start testing certificate ecosystems now
## 3 lessons from frontier AI vulnerability research
## Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
## Get started with Microsoft Security
Protect your people, data, and infrastructure with AI-powered, end-to-end security from Microsoft.
Connect with us on social
Microsoft
Post-quantum authentication: Why organizations should start testing certificate ecosystems now
blogs_microsoft·2026-10-08·CVSS 8.9
CVE-2026-73570 [HIGH] Post-quantum authentication: Why organizations should start testing certificate ecosystems now
## Microsoft Security Research
## Lora Randolph
Principal TPM Manager
## Tahmina Ahmad
Program Manager II
## Karina Sirota Goodley
Senior Security Program Manager
## 3 lessons from frontier AI vulnerability research
## Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
## Phishing Abuses RMM Tools for Persistent Access
## Get started with Microsoft Security
Protect your people, data, and infrastructure with AI-powered, end-to-end security from Microsoft.
Connect with us on social
Microsoft
3 lessons from frontier AI vulnerability research
blogs_microsoft·2026-10-07·CVSS 8.9
CVE-2026-73570 [HIGH] 3 lessons from frontier AI vulnerability research
Further reading:
Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark .
Beyond the benchmark: Advancing security at AI speed .
Evolving Windows vulnerability management to meet the speed of AI-powered discovery .
From research to reality: An interview with Microsoft VP of Security Research Taesoo Kim .
Microsoft Security FORGE Lab .
Berkeley Vulnerability Initiative—Agentic Vulnerability Coverage Map .
Akrites | Patch the Commons, Together .
Introducing MAI-Cyber-1-Flash inside MDASH | Microsoft AI .
To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn ( Microsoft Security ) and X ( @MSFTSecurity ) for t
Hackernews
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
blogs_hackernews·2026-09-30·CVSS 8.9
CVE-2026-73570 [HIGH] Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team.
The attack exploits CVE-2026-73570 (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol (SNMP) notifications are enabled and the optional zimbra-snmp package is installed.
Exploitation of CVE-2026-73570 can be triggered by a specially c
Microsoft
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
blogs_microsoft·2026-09-30·CVSS 8.9
CVE-2026-73570 [HIGH] Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
Zimbra persistence and privilege-escalation artifacts
This query combines process and file evidence for the systemd units, pre-authentication changes, PAM/sudo manipulation, and related artifacts observed in the investigation. Commands and file events must be correlated with runtime evidence before claiming durable persistence or successful privilege escalation.
let lookback = 30d;
union
(
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where ProcessCommandLine contains "zimlog.service"
or ProcessCommandLine contains "chronyd-helper.service"
or ProcessCommandLine contains "syslog_init.service"
or ProcessCommandLine contains "zimbraPreAuthKey"
or ProcessCommandLine contains "pam_exec"
or ProcessCommandLine contains "zmstat-fd"
or ProcessCommandLine contains "/etc/sudoers.d/81_metr
Rapid7
When Business Email Compromise Starts Rewriting Reality
blogs_rapid7·2026-09-24·CVSS 7.2
CVE-2024-45519 [HIGH] When Business Email Compromise Starts Rewriting Reality
Business Email Compromise (BEC) operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets.
This dynamic is central to our analysis as we kick off a series around Rapid7's collaborative research with Zimbra; upcoming installments will explore technical details and broader findings based within the Zimbra Collaboration Suite. Our investigation disrupted the traditional BEC model in unexpected ways. We uncovered over 50 vulnerabilities, and found that several allow attackers not just to observe environments, but to actively rewrite them by impersonating senders without credentials, controlling inbox visibility, and altering shared documents and calendars.
Hackernews
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
blogs_hackernews·2026-08-24
CVE-2026-19478 ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
A package gets installed. A login prompt opens. A box sits exposed to the internet. Nothing looks unusual yet.
That’s roughly the mood this week. Trusted tools turn hostile, old weak spots get fresh attention, AI makes exploit work cheaper, and researchers keep finding attacks that sound harder than they actually are.
Plenty to clean up. Here’s the short version.
## ⚡ Threat of the Week
U.S. Warns of AI-Powered Attacks on Siemens PLCs — Threat actors are using AI to write exploit scripts targeting internet-exposed Siemens S7 Series program
Hackernews
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
blogs_hackernews·2026-08-20·CVSS 6.1
CVE-2026-73570 [MEDIUM] Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska).
The vulnerability in question is CVE-2026-73570 (CVSS score: 8.9), which refers to a case of command injection that can lead to remote code execution.
"A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed, and SNMP notifications are enabled," according to a description of the flaw
2026-08-13
Published
2026-08-21
Added to CISA KEV
Exploited in the wild