CVE-2026-73570
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
CISA Known Exploited Vulnerability
Vendor / Product
Synacor — Zimbra Collaboration Suite (ZCS)
Date Added
2026-08-21
Remediation Due
2026-08-24
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-73570
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| synacor | zimbra_collaboration_suite | < 10.1.20 |
References & Advisories (4)
Vendor Advisory
US Government Resource
Third Party Advisory
Release Notes