CVE-2026-73570: Zimbra Collaboration SNMP notification OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows unauthenticated remote command execution, is listed in CISA KEV with a near-term remediation deadline, and has a high EPSS score.

What it is

Zimbra Collaboration Suite before 10.1.20 contains an OS command injection flaw in SNMP notification processing when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Untrusted input is not properly sanitized, so crafted SMTP requests can lead to arbitrary OS command execution. The flaw matters because it is remotely reachable without authentication and is listed in CISA KEV.

Impact

An unauthenticated attacker can execute arbitrary operating system commands as the Zimbra user, giving host-level access to mail data and the Zimbra service account. The CVSS vector rates confidentiality and integrity impact as high and availability impact as low.

Attack surface

Reachable over the network via crafted SMTP requests; the CVSS vector shows no privileges required and no user interaction. Exploitation requires the optional zimbra-snmp package to be installed and SNMP notifications enabled, which narrows the exposed population.

Exploitation

CVE-2026-73570 was added to CISA KEV on 2026-08-21 with a remediation due date of 2026-08-24, indicating known exploitation. EPSS is 0.32383 (98.2nd percentile), and a third-party advisory reference describes active exploitation; no ransomware campaign use is documented.

What to do

• Upgrade Zimbra Collaboration Suite to 10.1.20 or later, following the vendor security advisories.
• If patching cannot be done immediately, disable SNMP notifications or remove the optional zimbra-snmp package where it is not required.
• Restrict network access to SMTP services so only trusted mail relays can reach Zimbra.
• Apply CISA BOD 26-04 guidance, including forensics triage requirements, for internet-exposed Zimbra assets.
• Treat any internet-facing, unpatched Zimbra host with zimbra-snmp enabled as compromised and begin incident response.

Detection

• Review Zimbra and host logs for unexpected child processes spawned by the Zimbra user, especially shell or command interpreters.
• Monitor SMTP traffic for anomalous or malformed requests that coincide with SNMP notification activity.
• Audit which Zimbra hosts have the zimbra-snmp package installed and SNMP notifications enabled.
• Hunt for outbound connections or file changes made by the Zimbra service account outside normal mail operations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.