Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
CISA: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
CVE-2026-73570 is an OS command injection vulnerability (CWE-78) in Synacor Zimbra Collaboration Suite (ZCS) before 10.1.20, caused by improper sanitization of untrusted input during SNMP notification processing. It is triggered when the optional zimbra-snmp package is installed and SNMP notifications are enabled: an unauthenticated attacker sends specially crafted SMTP requests that the flawed notification path turns into execution of arbitrary operating system commands. Successful exploitation runs commands as the Zimbra user, giving attackers control of the mail server's service account with high confidentiality and integrity impact across the host. Only ZCS deployments running the optional SNMP component with notifications enabled are vulnerable; other Zimbra installs are not exposed to this specific flaw. The flaw is under active exploitation: CISA added it to the KEV catalog on 2026-08-21, Poland's CERT has warned of in-the-wild attacks, unpatched Zimbra servers are reported compromised, and two public proof-of-concept exploits exist.
What to do: Upgrade to Zimbra Collaboration Suite 10.1.20 or later per vendor instructions; as an interim mitigation, disable SNMP notifications or remove the zimbra-snmp package on hosts that do not need it. Federal operators must satisfy the CISA KEV/BOD 26-04 requirement, and all administrators of internet-facing Zimbra servers should hunt for signs of compromise (unexpected processes or persistence under the zimbra user) since unpatched systems are already being exploited.
| Product | Affected |
|---|---|
| Synacor Zimbra Collaboration Suite (ZCS) | before 10.1.20 (when the optional zimbra-snmp package is installed and SNMP notifications are enabled) |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Microsoft details active exploitation of Zimbra CVE-2026-73570 unauthenticated command injection granting root access, web shells, and theft of mailbox authentication secrets.
Attackers exploited Zimbra CVE-2026-73570 before disclosure to plant shells, steal mail, and move laterally.
Attackers are exploiting critical Zimbra flaw CVE-2026-73570 to steal organizational email and credentials.
Microsoft says crafted mail runs commands when SNMP notifications are on, then webshells and mailbox staging follow; fix is 10.1.20.
Attackers exploit patched Zimbra CVE-2026-73570 to plant web shells and steal mailbox and authentication secrets.
Attackers are exploiting Zimbra CVE-2026-73570 for unauthenticated command execution and credential theft on exposed mail servers.
Microsoft tracks in-the-wild exploitation of unauthenticated Zimbra command injection CVE-2026-73570 on internet-facing mail servers.
Attackers exploited Zimbra CVE-2026-73570 for unauthenticated RCE after patching but before public disclosure.
CISA added actively exploited Zimbra OS command injection flaw CVE-2026-73570 to its KEV catalog, urging users to patch by August 24, 2026.
Attackers are exploiting unpatched Zimbra servers via CVE-2026-73570; 274 instances compromised, and CISA added the flaw to its KEV catalog.
CISA gave US agencies three days to patch actively exploited Zimbra flaw CVE-2026-73570, which allows full takeover of user communications.
CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.
CISA added actively exploited Zimbra flaw CVE-2026-73570 (unauthenticated OS command injection RCE) to its KEV catalog, setting an August 24, 2026 federal patch deadline.
CERT Polska and CISA report active exploitation of Zimbra RCE CVE-2026-73570, with 267 instances compromised per Shadowserver.
A malformed SMTP recipient is logged and run by Swatchdog as the zimbra user; fix is 10.1.20 or later.
Rapid7 and Zimbra research details 50+ Zimbra flaws enabling BEC attacks that impersonate senders, rewrite documents, and manipulate calendars.
Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.
Today 369 readers · 400 views · 302 reads · all time 158K views