Search/CVE-2026-73570
● CVE — High

CVE-2026-73570

VendorsynacorProductzimbra collaboration suiteDiscoveredAug 13, 2026UpdatedAug 24, 2026

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

View graph Watch Export
CVSS v3.1
8.9 HIGH
EPSS
71.7%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
9
sources referencing this CVE
Related IOCs
3
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 7, 2026
▲ 71.1pp
0.54% → 71.7% over 8 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityLOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Connections
13 relationships
Timeline
disclosure → media coverage
Aug 13, 2026
Disclosure — published as a CVE record. · last revised by NVD Aug 24, 2026
Aug 20, 2026
thehackernews.com reports: Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
Aug 20, 2026
securityweek.com reports: Hackers Target Zimbra Servers in Active Exploitation Campaign
Aug 24, 2026
darkreading.com reports: Exploited Zimbra Flaw Highlights Shrinking Window to Patch
Aug 25, 2026
helpnetsecurity.com reports: Unpatched Zimbra servers are falling to CVE-2026-73570 attacks
Aug 30, 2026
helpnetsecurity.com reports: Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited
Sep 30, 2026
thehackernews.com reports: Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Oct 1, 2026
securityweek.com reports: Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure
Oct 1, 2026
theregister.com reports: Microsoft catches hackers exploiting Zimbra bug before disclosure
Oct 5, 2026
acn.gov.it reports: Zimbra ZCS: rilevato sfruttamento di vulnerabilità in versioni non aggiornate
Public PoC (9)
github.com/HORKimhab/CVE-2026-73570github.com/BiuTrap/CVE-2026-73570github.com/jishino567/CVE-2026-73570github.com/gabrielunknown/CVE-2026-73570github.com/INFOKOM-KI/Zimbra-CVE-2026-73570-Rulesgithub.com/dahnutz/zimbra-cve-2026-73570-irgithub.com/juanpoch/CVE-2026-73570github.com/hainhc/CVE-2026-73570github.com/0xredash/CVE-2026-73570
Unverified third-party code — review before executing.