CVE-2026-73570: listed in the CISA KEV catalog

CVE-2026-73570 · CVSS 8.9 HIGH · EPSS 77% · KEV 2026-08-21 · patch available

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Is CVE-2026-73570 exploited?

• Listed in the CISA KEV catalog on 2026-08-21.
• Federal remediation due 2026-08-24.
• Past that date by 81 days.
• EPSS puts exploitation in the next 30 days at 77%.
• Public exploit code: none found in monitored sources.
• Public detection rules exist.

Which products and versions are affected?

• Zimbra · Collaboration · >= 0, < 10.1.20
• synacor · zimbra collaboration suite · < 10.1.20

Is there a patch?

Yes. Update to one of these or later:

From Zimbra's CVE record · Zimbra advisory

What PlainSec published about CVE-2026-73570

• Zimbra PoCs can miss command injection in Swatchdog (2026-10-23)
• Rapid7 finds Zimbra can rewrite collaboration trust (2026-09-25)
• Zimbra flaw is being exploited in the wild (2026-08-20)

Primary sources

• NVD record
• CISA KEV catalog
• Zimbra advisory
• Nuclei template

KEV and EPSS are re-checked daily. Record last updated 2026-11-08.