LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
cve recordhighexploited in the wild3 of 3 cataloguesexploit reported

CVE-2026-73570

Synacor · Zimbra Collaboration Suite (ZCS) · Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

Published · Added to CISA KEV
CVSS8.9
Severityhigh
WeaknessCWE-78
EPSS71.7%99.4th percentile
Exploited3 KEV sources
Ransomware useUnknown
Federal fix dueAug 24, 2026

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

patch window

Called exploited 4 days after disclosure.

Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.

The life of this vulnerability

  1. CVE published
  2. First KEV listing4d
  3. Last KEV listing4d
  4. Last sighting12d

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

Sources3 of 3
Listings differ by4 d
Strongest claimconfirmed

3 catalogues list it. CIRCL aggregates the others and is shown but not counted.

Public exploitation evidence

9 public reports collected from VulnCheck and CIRCL, first on Aug 17, 2026. Each links to its original source. We have not verified them.

Description

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

← Back to the CVE Tracker

Our coverage of CVE-2026-73570

CVE-2026-73570

Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

Threat actors are actively exploiting a previously disclosed vulnerability in Zimbra Collaboration Suite (ZCS) to gain unauthorized access and exfiltrate sensitive information, as reported by the Microsoft Security Research team. The attacks involve the deployment of web shells and subsequent harvesting of authentication secrets, indicating a sophisticated post-exploitation strategy aimed at…

CVE-2026-73570

Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited

Attackers are actively exploiting a previously patched vulnerability in Citrix NetScaler ADC and Gateway, identified as CVE-2026-8452. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed this exploitation by adding the flaw to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-73570

Unpatched Zimbra servers are falling to CVE-2026-73570 attacks

At least 274 internet-facing Zimbra Collaboration Suite (ZCS) instances have been compromised through exploitation of CVE-2026-73570, a code injection vulnerability. The Shadowserver Foundation, a nonprofit security organization, reported the rising number of compromises after initially identifying 155 affected instances on August 20.

CVE-2026-73570

Exploited Zimbra Flaw Highlights Shrinking Window to Patch

A recently exploited vulnerability in Zimbra, identified as CVE-2026-73570, has prompted a directive from the Cybersecurity and Infrastructure Security Agency (CISA) for federal agencies to apply patches within a three-day window. The flaw is reported to enable a complete takeover of a user's communications, underscoring the critical nature of the exploit and the urgency of mitigation.

CVE-2026-19478high

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

This week's cybersecurity reporting highlights several significant threats, including the emergence of AI-powered attacks against industrial control systems (ICS), active exploitation of a critical vulnerability in GitLab, and the discovery of trojanized npm packages distributing a sophisticated Linux backdoor. Further reports detailed a novel method for exploiting expired credit cards in…

CVE-2026-73570critical

U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Zimbra Collaboration Suite (ZCS), identified as CVE-2026-73570, to its Known Exploited Vulnerabilities (KEV) catalog. This move mandates that all U.S. federal civilian executive branch (FCEB) agencies address the flaw by August 24, 2026, to protect their networks, and private organizations…

CVE-2026-73570critical

Poland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw

CERT Polska has confirmed active exploitation of a critical unauthenticated remote code execution vulnerability in Zimbra Collaboration Suite, identified as CVE-2026-73570. The flaw, which allows attackers to execute arbitrary shell commands with the privileges of the `zimbra` user, was patched by Zimbra on July 20, 2026, in version 10.1.20. Active exploitation was confirmed less than a month…

CVE-2026-73570

Hackers Target Zimbra Servers in Active Exploitation Campaign

CERT Polska has reported an active exploitation campaign targeting Zimbra Collaboration servers. The campaign specifically leverages a vulnerability identified as CVE-2026-73570. Details surrounding the nature of the attacks and the specific impact on affected systems are currently emerging, with CERT Polska providing the initial public alert.

CVE-2026-73570critical

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

Attackers are reportedly exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS) that enables unauthenticated remote code execution. The flaw, tracked as CVE-2026-73570 and assigned a CVSS score of 8.9, is attributed to insufficient input sanitization within the Simple Network Management Protocol (SNMP) notification processing component of ZCS.