Vulnerability Intelligence Report
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
CISA KEV
Nuclei Template
SSVC: Active Exploitation
Injection
CVSS Base Score
8.9
HIGH
Exploitability:2.3
Impact Score:6.0
EPSS Probability:1.04%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-78 ↗CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Zimbra | Collaboration | 0 < 10.1.20 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
1.042%
GitHub Advisory
Vulnerability Class
Injection
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2026-08-12T21:44:20 |
| Published | 2026-08-13T15:19:42 |
| Last Updated | 2026-08-24T12:17:51 |
Community Chatter & Buzz