CVE-2026-73570: Zimbra Collaboration: OS Command Injection

Analysis on rafaelpfister.ch

Article · October 6, 2026 CVE-2026-73570: Zimbra Command Injection via SNMP Is Being Exploited—Update to 10.1.20 and Check for Compromise A crafted email is all it takes: On Zimbra servers with the zimbra-snmp package and SNMP notifications enabled, attackers can execute commands as the zimbra user without authentication (CVE-2026-73570, CVSS 8.9). The vulnerability is being exploited and was fixed in 10.1.20. Update, apply the workaround until then, and check for web shells and persistence.

Vendor description

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Reference data

Vendor

Zimbra

Affected products

Collaboration

CVSS 3.1

8.9 (HIGH)

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Weakness type

CWE-78: OS Command Injection

Published

August 13, 2026

In KEV catalog since

August 21, 2026

US federal deadline

August 24, 2026

Official sources

← All vulnerabilities