Remote Code Execution in Zimbra Collaboration through Improper Input Sanitization
CVE-2026-73570

8.9HIGH

Key Information:

Vendor

Zimbra

Status
Collaboration
Vendor
CVE Published:
13 August 2026

Badges

📈 Trended📈 Score: 3,620💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 71%🦅 CISA Reported📰 News Worthy

What is CVE-2026-73570?

CVE-2026-73570 is a critical remote code execution vulnerability found in Zimbra Collaboration Suite (ZCS) versions prior to 10.1.20, particularly when the optional zimbra-snmp package is installed and SNMP notifications are active. Zimbra is an open-source collaboration platform used by various organizations for email and calendar functionalities. The vulnerability arises from improper sanitization of untrusted input during the processing of SNMP notifications, enabling unauthenticated attackers to dispatch specially crafted SMTP requests. This could allow these attackers to execute arbitrary commands on the underlying operating system as the Zimbra user, severely compromising the security and integrity of the affected systems.

Potential impact of CVE-2026-73570

  1. Remote Code Execution: The vulnerability can be exploited to execute arbitrary operating system commands, granting attackers significant control over the server. This risk can lead to full system compromise, allowing attackers to manipulate data, install malware, or orchestrate further attacks within the network.

  2. Data Breaches: Unauthorized command execution may facilitate data breaches, where sensitive organizational and personal information accessed through Zimbra can be exfiltrated. Such breaches can lead to regulatory penalties, loss of reputation, and financial harm due to compromised client trust.

  3. Service Disruption: Exploitation of this vulnerability may result in service interruptions, impacting business operations that rely on the Zimbra platform. This disruption can lead to downtime, loss of productivity, and financial repercussions as services become unavailable to users.

CISA has reported CVE-2026-73570

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-73570 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

Collaboration 0 < 10.1.20

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-73570
Created by HORKimhab

CVE-2026-73570
Created by gabrielunknown

CVE-2026-73570
Created by juanpoch

News Articles

favicon imageNewsbreak

Zimbra CVE-2026-73570 Harvested the Signing Keys That Authenticate Every Session on the Platform - NewsBreak

Harvested authentication secrets — specifically the zimbraPreAuthKey, zimbraAuthTokenKey, and zimbraTwoFactorAuthSecret — have transformed the exploitation

2 weeks ago

favicon imageWebpronews

Zimbra Mail Servers Under Siege: How One Crafted Email Unlocked Mass Credential Theft

Attackers exploited CVE-2026-73570 in Zimbra Collaboration Suite by sending crafted emails that triggered unauthenticated command injection when SNMP notifications were enabled. Microsoft observed web shells, privilege escalation, and mailbox data theft on hundreds of servers before the flaw's publi...

2 weeks ago

favicon imageSecurityweek

Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure

Exploitation of CVE-2026-73570, an unauthenticated OS command injection in Zimbra, started shortly after patches rolled out.

2 weeks ago

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://wiki.zimbra.com/wiki/Security_Center

EPSS Score

71% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 💰

    Used in Ransomware

  • 🟡

    Public PoC available

  • 📈

    Vulnerability started trending

  • 🦅

    CISA Reported

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by Securityweek

  • Vulnerability published

  • Vulnerability Reserved

.