Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-73570 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-08-21 |
| Vendor | Synacor |
| Product | Zimbra Collaboration Suite (ZCS) |
| Affected versions | all before 10.1.20 |
| CVSS Score | 8.9 (high) |
| EPSS Score | 0.5% (percentile: 43%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| CISA Remediation Deadline | 2026-08-24 |
Vulnerability Description
Zimbra Collaboration Suite (ZCS) before version 10.1.20 contains a remote code execution
vulnerability. Exploitation requires the optional zimbra-snmp package to be installed
and SNMP notifications to be enabled.
The root cause is improper sanitization of untrusted input during SNMP notification
processing. An unauthenticated attacker can send a specially crafted SMTP request that
results in execution of arbitrary operating system commands as the zimbra user.
The vulnerability is listed in the CISA KEV catalog — it is being exploited in the wild. CERT Polska has also issued an advisory for the Polish market.
Required Actions
- Upgrade ZCS to 10.1.20 or later — this is the only complete fix.
- If upgrading today is not possible: check whether the
zimbra-snmppackage is installed and disable SNMP notifications or remove the package. Without that component the installation is not exposed to this vector. - Restrict public network access to the Zimbra SMTP service to required addresses only.
- Because the flaw is actively exploited, review the host for prior compromise after
patching: unexpected processes owned by the
zimbrauser, new cron jobs, modified files in web directories, and outbound connections from the mail server.
Who Is Affected?
Organizations running Zimbra Collaboration Suite by Synacor — a common Microsoft Exchange alternative, widely deployed in public administration, universities and mid-sized companies that operate their own mail server.
Critical condition: only installations with the optional zimbra-snmp package and SNMP
notifications enabled are exposed. Verifying that condition takes minutes and separates
real exposure from noise.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
