CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
What it is
Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
What to do
Treat this as urgent. Identify every affected system, starting with anything internet-facing, and apply the vendor fix or mitigation within days. If you cannot patch quickly, isolate or disable the affected service and watch for signs of compromise.
- Priority
- Act now: Patch or mitigate internet-facing systems within days.
- Severity (CVSS)
- 8.9 high
- CISA assessment (SSVC)
- actively exploited; needs manual effort per target; total control of the affected system
- Exploit probability (EPSS, 30 days)
- 72%, in the top 1% of all CVEs
- Added to CISA KEV
- 21 August 2026
- CISA fix-by date
- 24 August 2026 (US federal agencies; a sensible deadline for everyone)
- Ransomware use
- Not known
- Weakness
- CWE-78
References
- NIST NVD entry
- CISA KEV entry
- wiki.zimbra.com/wiki/Security_Center
- wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-coll
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570
Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.