CVE-2026-73570 command injection in Zimbra yields remote code execution
A malformed SMTP recipient is logged and run by Swatchdog as the zimbra user; fix is 10.1.20 or later.
64
Vendor
Zimbra
- Mentions · 7d0
- Mentions · 30d6
- All mentions18
- First seenAug 21, 2026
- Last mentioned8d ago
Timeline
18 articles · newest firstAttackers exploit Zimbra zero-click flaw CVE-2026-73570 on email servers
Microsoft says crafted mail runs commands when SNMP notifications are on, then webshells and mailbox staging follow; fix is 10.1.20.
84
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Rapid7 details dozens of Zimbra flaws, including mailbox impersonation and cross-user access, with some fixes still missing.
71
Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week
GBHackers' weekly digest highlights NetScaler zero-days, a 3-million-person Pentagon breach, and multiple AI security incidents.
42
Microsoft catches hackers exploiting Zimbra bug before disclosure
Attackers exploited Zimbra CVE-2026-73570 before disclosure to plant shells, steal mail, and move laterally.
86
Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure
Attackers exploited Zimbra CVE-2026-73570 for unauthenticated RCE after patching but before public disclosure.
78
Hackers Exploit Zimbra Mail Servers With Crafted Emails to Gain Remote Access
Attackers are exploiting Zimbra CVE-2026-73570 for unauthenticated command execution and credential theft on exposed mail servers.
82
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Attackers exploit patched Zimbra CVE-2026-73570 to plant web shells and steal mailbox and authentication secrets.
84
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
Microsoft tracks in-the-wild exploitation of unauthenticated Zimbra command injection CVE-2026-73570 on internet-facing mail servers.
82
Zimbra security advisory (AV26-964)
Canada's Cyber Centre urges updates for Zimbra Collaboration Suite releases before 10.1.21 over unspecified vulnerabilities.
32
August 2026 CVE Landscape
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
68
Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited
Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.
25
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
CERT Polska and CISA report active exploitation of Zimbra RCE CVE-2026-73570, with 267 instances compromised per Shadowserver.
75
CISA Warns of Zimbra OS Command Injection Vulnerability Active Exploitation (CVE-2026-73570)
CISA added actively exploited Zimbra OS command injection flaw CVE-2026-73570 to its KEV catalog, urging users to patch by August 24, 2026.
78
Unpatched Zimbra servers are falling to CVE-2026-73570 attacks
Attackers are exploiting unpatched Zimbra servers via CVE-2026-73570; 274 instances compromised, and CISA added the flaw to its KEV catalog.
78
Exploited Zimbra Flaw Highlights Shrinking Window to Patch
CISA gave US agencies three days to patch actively exploited Zimbra flaw CVE-2026-73570, which allows full takeover of user communications.
78
U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Zimbra flaw CVE-2026-73570 (unauthenticated OS command injection RCE) to its KEV catalog, setting an August 24, 2026 federal patch deadline.
76
Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw
CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.
78
Related CVEs
by mentions- CVE-2026-7357072%8.9Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
- CVE-2026-7289899%10.0Unauthenticated SQL Injection in Metabase Grants Admin Access
- CVE-2026-6000424%9.8Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
- CVE-2025-6259360%9.4Actively Exploited Browser-Based RCE in Ray AI Compute Engine
- CVE-2026-84521%8.8Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild
- CVE-2026-8157885%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2025-6637620%6.1Stored Cross-Site Scripting in Synacor Zimbra Collaboration Suite Classic UI
- Sieve notify bypasses mail-forward policy in Zimbra
- EWS FindItem Authorization Bypass in Zimbra Collaboration
- LDAP filter injection in Zimbra Collaboration 10.1
Appears with
- Zimbra Collaboration Suiteproduct · 11
- CISAorganization · 8
- CERT Polskaorganization · 5
- Microsoftorganization · 5
- CISAvendor · 4
- Zimbraproduct · 3
- Shadowserver Foundationorganization · 3
- zimdown2malware · 2
- Citrixvendor · 2
- CERT Polskavendor · 2
- FBIorganization · 2
- Microsoftvendor · 2
- ShinyHuntersthreat actor · 2
- PaperCutvendor · 2
- Synacorvendor · 2
- zimclient2malware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.