U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Zimbra flaw CVE-2026-73570 (unauthenticated OS command injection RCE) to its KEV catalog, setting an August 24, 2026 federal patch deadline.
CISA added CVE-2026-73570, an unauthenticated OS command injection flaw in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities catalog after CERT Polska confirmed active exploitation. The flaw lets attackers execute shell commands as the zimbra user via the snmp_notify parameter when the SNMP trap service is enabled and the default swatchdog service is running. Zimbra patched the issue in version 10.1.20 released July 20, 2026, 28 days before exploitation was confirmed. Under BOD 22-01, federal civilian agencies must patch by August 24, 2026.
- CVE-2026-73570 allows unauthenticated shell command execution with the zimbra user's privileges.
- Exploitation requires the zimbra-snmp package with SNMP notifications; swatchdog runs by default.
- Patch shipped July 20, 2026 (10.1.20); exploitation confirmed 28 days later.
- CERT Polska advises checking zimbra.log and files created by user zimbra in webapps and /tmp.
- BOD 22-01 sets an August 24, 2026 patch deadline for federal agencies.
- CVEs
- CVE-2026-73570
- Vendors
- ZimbraCISACERT Polska
- Products
- Zimbra Collaboration Suite
- Organizations
- CISACERT PolskaZimbra
- Countries
- PolandUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73570 | Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite | 8.9 | 72% | KEVPoC ×5 | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.