CVE-2026-73570: listed in the CISA KEV catalog

CVE-2026-73570 · CVSS 8.9 HIGH · EPSS 12% · KEV 2026-08-21 · patch available

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Is CVE-2026-73570 exploited?

• Listed in the CISA KEV catalog on 2026-08-21.
• Federal remediation due 2026-08-24.
• Past that date by 32 days.
• EPSS puts exploitation in the next 30 days at 12%.
• Public exploit code: none found in monitored sources.
• Public detection rules exist.

Which products and versions are affected?

• Synacor · Zimbra · <10.1.20
• Zimbra · Collaboration · >= 0, < 10.1.20

Is there a patch?

• Zimbra 10.1.20

What PlainSec published about CVE-2026-73570

• Rapid7 Finds Zimbra Can Rewrite Collaboration Trust (2026-09-24)
• Zimbra Flaw Is Being Exploited in the Wild (2026-08-20)

Primary sources

• NVD record
• CISA KEV catalog
• Nuclei template

KEV and EPSS are re-checked daily. Record last updated 2026-09-24.