RCE in Synacor Zimbra Collaboration Suite
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.9 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L.
EPSS exploit prediction
EPSS 0.766, 99.5th percentile (scored ); up from 0.717 30 days earlier. About EPSS.
EPSS over last 30 days · oldest: 0.717 · newest: 0.766 · change: +0.050
Affected products
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Browse the full CISA KEV catalog with PoC counts, Metasploit modules and EPSS.
Public exploits and proof-of-concept code
11 public repositories with exploit or proof-of-concept code for this CVE:
- HORKimhab/CVE-2026-73570 (5 stars, last pushed 2026-08-25): CVE-2026-73570
- gabrielunknown/CVE-2026-73570 (4 stars, last pushed 2026-09-14): Zimbra SNMP Notification OS Command Injection — Unauthenticated RCE via SMTP exploit (Poc)
- jishino567/CVE-2026-73570 (4 stars, last pushed 2026-08-25): PoC for CVE-2026-73570 (Zimbra SMTP Command Injection)
- dahnutz/zimbra-cve-2026-73570-ir (2 stars, last pushed 2026-10-18): Detection-first, evidence-preserving incident-response toolkit for Zimbra CVE-2026-73570. Includes read-only host checks, IOC feeds, triage, persistence, containment, and recovery guidance based on s…
- 0xBlackash/CVE-2026-73570 (2 stars, last pushed 2026-09-30): CVE-2026-73570
- 0xredash/CVE-2026-73570 (2 stars, last pushed 2026-09-30): CVE-2026-73570
- ashrafzaryouh/CVE-2026-73570 (2 stars, last pushed 2026-09-30): CVE-2026-73570
- juanpoch/CVE-2026-73570 (last pushed 2026-09-13): Zimbra Collaboration Suite RCE — SMTP log poisoning → swatchdog → OS Command Injection (CVSS 8.9, CISA KEV)
- hainhc/CVE-2026-73570 (last pushed 2026-09-10)
- BiuTrap/CVE-2026-73570 (last pushed 2026-09-02): CVE-2026-73570 PoC
1 more are listed on the interactive page.
References
- wiki.zimbra.com/wiki/Zimbra_Security_Advisories (Vendor Advisory)
- wiki.zimbra.com/wiki/Security_Center (Release Notes)
- moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-col… (Third Party Advisory)
- www.cisa.gov/known-exploited-vulnerabilities-catalog (US Government Resource)
This CVE has public exploit evidence. See the latest CVEs with public exploits.