CVE-2026-73570 Zimbra Collaboration Suite (ZCS) OS Command Injection

Exploited in the wild High 8.9 Published 13 Aug 2026 Updated 24 Aug 2026

Unauthenticated attackers can execute arbitrary OS commands via crafted SMTP requests if SNMP notifications are enabled in Zimbra Collaboration.

Exploited in the wild: Since 21 Aug 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-73570?

CVE-2026-73570 is a high-severity command injection vulnerability in Synacor Zimbra Collaboration Suite, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Weakness: CWE-78

Which versions are affected by CVE-2026-73570?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2026-73570?

No fix has been published for CVE-2026-73570 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Aug 2026.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-73570 being exploited?

Yes. Attackers have exploited CVE-2026-73570 in the wild since at least 21 Aug 2026.

Public exploit code: 1 Nuclei template and 9 proofs of concept on GitHub.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-jqh7-pchh-v74j.