HIGH

CVE-2026-73570

Synacor Zimbra Collaboration Suite 2026-08-13 CVSS v3.1

CVSS

8.9

KEV

Description

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Weakness (CWE)

CWE-78 OS Command Injection

EPSS Score

32.38%

Probability of exploitation in next 30 days

98.3th percentile

References

https://wiki.zimbra.com/wiki/Security_Center Release Notes https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/ Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE