SECURELYN
Free ScanFree consultation

CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Scores

8.9
CVSS 8.9 out of 10, high severity.
71.7%
EPSS 71.7% chance of exploitation in the next 30 days.

The facts

Published
13 August 2026
Last changed
24 August 2026
NVD status
Analyzed
Severity
High, CVSS 8.9 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
Affects
  • synacor zimbra collaboration suite
Known exploited
Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 21 August 2026.
EPSS
71.7% chance of exploitation activity in the next 30 days (percentile 99).

Is there a Securelyn advisory?

Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.

References