CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Other sources
Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73570?
The severity of CVE-2026-73570 is high with a CVSS score of 8.9.
How can I fix CVE-2026-73570?
To mitigate CVE-2026-73570, upgrade to Zimbra Collaboration version 10.1.20 or later and disable the optional zimbra-snmp package if not needed.
What impact does CVE-2026-73570 have on systems?
CVE-2026-73570 allows an unauthenticated attacker to execute remote code on affected Zimbra Collaboration servers.
What conditions need to be met for CVE-2026-73570 to be exploited?
CVE-2026-73570 can be exploited when the zimbra-snmp package is installed and SNMP notifications are enabled.
What should I do if I can't upgrade to resolve CVE-2026-73570?
If you cannot upgrade, it is recommended to disable the zimbra-snmp package and monitor your environment for any suspicious activity.