CVE-2026-73570: Zimbra Collaboration Suite SNMP Command Injection (KEV)

CVE-2026-73570 is an unauthenticated OS command injection vulnerability in the optional SNMP monitoring component of Zimbra Collaboration Suite (ZCS): when the zimbra-snmp package is installed and SNMP notifications are enabled, a remote attacker can send a crafted SMTP request that runs arbitrary operating system commands as the Zimbra user, and it was exploited in the wild before Zimbra shipped a permanent fix, earning a 3-day CISA KEV remediation window.

CVE-2026-73570 affects Zimbra Collaboration Suite (ZCS), the open-source/commercial email and collaboration platform from Synacor. NVD's description states: "A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user" (NVD).

NVD's own CVSS v3.1 metric for this CVE is 8.9 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L — network-reachable with no privileges or user interaction, though attack complexity is High and the scope is Changed, reflecting that the attacker must successfully trigger the SNMP notification path. CWE-78 (OS Command Injection) is the assigned weakness (NVD).

Zimbra's own security-advisory wiki confirms CVE-2026-73570 was "fixed a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled," shipped in ZCS 10.1.20 (Zimbra Security Advisories). Zimbra's patch-release blog post for 10.1.20 states this release "contains fixes for multiple critical security issues including a permanent fix for the critical SNMP vulnerability disclosed in our recent security advisory" on 26 June 2026 — i.e. an earlier advisory had already warned of the issue and offered interim mitigation (disabling SNMP notifications) before the permanent code fix landed in 10.1.20 (Zimbra Blog: Patch Release Update 10.1.20).

CISA added CVE-2026-73570 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-21, with a required-action due date of just 2026-08-24 (3 days) and marked the CVE for mandatory forensic triage, both signals CISA reserves for vulnerabilities already under confirmed active exploitation (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.71663 (99.418th percentile) — very high, consistent with an unauthenticated, remotely triggerable command injection in internet-facing mail infrastructure with confirmed in-the-wild use (FIRST EPSS).

Any Zimbra deployment with the zimbra-snmp package installed and SNMP notifications enabled should be upgraded to 10.1.20 or later immediately; administrators who cannot patch right away should disable SNMP notifications as an interim mitigation and review mail-transport logs for anomalous SMTP traffic to the SNMP notification path.

• OS command injection (CWE-78) in the SNMP monitoring component, reachable via crafted SMTP requests when zimbra-snmp is installed and SNMP notifications are enabled, lets an unauthenticated attacker run OS commands as the Zimbra user. — NVD
• NVD's own CVSS v3.1 score is 8.9 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L). — NVD
• Confirmed on Zimbra's own security-advisory wiki as fixed in ZCS 10.1.20; a prior June 26, 2026 advisory had already disclosed the issue and offered interim mitigation before the permanent fix shipped. — Zimbra Security Advisories
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-21, required action due 2026-08-24, flagged for mandatory forensic triage. — CISA KEV
• EPSS score is 0.71663 (99.418th percentile) as of 2026-10-27. — FIRST EPSS