Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability (CVE-2026-73570)

What is affected, what to do

An OS command injection vulnerability in Zimbra Collaboration Suite (ZCS) prior to version 10.1.20 allows an unauthenticated attacker to send specially crafted SMTP requests, potentially executing arbitrary OS commands as the Zimbra user. This vulnerability is actively exploited in ransomware campaigns since 2026. Affected systems have the optional zimbra-snmp package installed with SNMP notifications enabled. Immediate patching to version 10.1.20 or higher is critical to mitigate the risk.

The vulnerability is being actively exploited; treat it as a priority. Update Zimbra Collaboration to version 10.1.20. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Zimbra Collaboration lt *..10.1.20

Fixed in

• Zimbra Collaboration 10.1.20

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Scope the exposure: On every ZCS node (MTA nodes first), check whether the optional zimbra-snmp package is installed (rpm -qa | grep zimbra-snmp or dpkg -l | grep zimbra-snmp) and whether SNMP notifications are enabled (e.g. su - zimbra -c "zmprov gcf zimbraSnmpNotify"; confirm the attribute name for your release). Only that combination is vulnerable according to the advisory.
   • Patch: Upgrade to ZCS 10.1.20 or later. NVD lists all versions before 10.1.20 as affected. Check the Synacor/Zimbra vendor advisory and release notes to confirm, since the CPE entry is inconsistent with the NVD description.
   • If you cannot upgrade today: Disable SNMP notifications (zmprov mcf zimbraSnmpNotify FALSE, then zmcontrol restart) or remove the zimbra-snmp package if no monitoring depends on it.
   • Compromise assessment: The attack surface is unauthenticated SMTP (25/tcp), so review every exposed node for unexpected process trees, zimbra user cron jobs (crontab -l -u zimbra), ~zimbra/.ssh/authorized_keys, and webshells under /opt/zimbra/jetty*/webapps/.
   • On any hit: Isolate the node, take a forensic image, then rotate LDAP, MySQL and admin credentials (zmlocalconfig -s) and TLS keys, and invalidate admin sessions.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration: Run zimbra-snmp only where it is operationally required. Move SNMP monitoring to external agents such as node_exporter or a Zabbix agent instead.
   • Network segmentation: Keep ZCS in a dedicated DMZ. Restrict outbound traffic from mail servers to what they need (SMTP relay, update repositories) so attackers cannot fetch payloads or open reverse shells.
   • Upstream mail gateway / IPS: Filter shell metacharacters ($(, backticks, ${IFS}, ;, |, &&) in the SMTP envelope (MAIL FROM, RCPT TO) and in headers. Suricata idea: alert smtp any any -> $ZIMBRA_MTA 25 (msg:"Possible Zimbra SNMP command injection"; content:"RCPT TO"; nocase; pcre:"/(\$\(||${IFS})/"; sid:...)`.
   • Endpoint hardening: Use AppArmor, SELinux or an EDR policy to block zimbra-owned processes from launching curl, wget, nc or python with outbound network connections.
   • Least privilege: Audit the zimbra user's sudo rights (sudo -l -U zimbra) and remove anything unnecessary, because escalation to root is the expected next step.
3. 03

   Runbook step 3

   Detection rules

   • auditd: Track execve events with uid=zimbra (or auid) for /bin/sh, /bin/bash, curl, wget, base64 and nc. Rule: -a always,exit -F arch=b64 -S execve -F uid=<zimbra-uid> -k zimbra_exec.
   • EDR process ancestry: Alert on a Zimbra Perl or Java process under /opt/zimbra/ (log-watch or SNMP notification components) → sh -c → network tool. Sigma shape: ParentImage|contains: '/opt/zimbra/' AND Image|endswith: ['/sh','/bash','/curl','/wget'] AND User: zimbra.
   • MTA logs: Search /var/log/zimbra.log or /var/log/mail.log for sender or recipient addresses that contain shell syntax. SPL: index=mail sourcetype=postfix ("$(" OR "${IFS}" OR "")`.
   • Zeek / network: Check smtp.log for anomalous rcptto and mailfrom values. Correlate with first-seen outbound connections from mail servers in conn.log, especially HTTP/HTTPS and high ports.
   • Filesystem: Alert via FIM or auditd on new .jsp files under /opt/zimbra/jetty*/webapps/ and on changes to the zimbra crontab or authorized_keys (-w /opt/zimbra/jetty_base/webapps -p wa -k zimbra_web).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Source: pwn.watch, CISA KEV Catalog, cvelistv5, NVD (NIST), CSA/SingCERT

Vendors and products

• Zimbra Zimbra Collaboration
• Zimbra Zimbra Collaboration

Weakness classes (CWE)

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  Base

  The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

  Entry at MITRE CWE-78

References & sources

• wiki.zimbra.comSynacor Zimbra Collaboration Suite (ZCS) — CVE-2026-73570pwn-watch
• wiki.zimbra.comwiki/Security_Center
• moje.cert.plkomunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-…Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570government-resource
• pwn.watchpwn.watch: Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-73570pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 24.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-73570","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-13T00:00:00+00:00"}	{"id":"CVE-2026-73570","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-22T03:55:17.911879Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 22.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-73570","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-21T17:18:39.211103Z"}	{"id":"CVE-2026-73570","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-13T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Linked advisories

• Zimbra Vulnerability Exploited in the Wild Prior to Public DisclosureSecurityWeek01.10.2026
• Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication SecretsThe Hacker News30.09.2026
• @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33SANS @RISK27.08.2026
• Exploited Zimbra Flaw Highlights Shrinking Window to PatchDark Reading24.08.2026
• KEV: Oracle, Zimbra, TrueConfSANS NewsBites21.08.2026
• Hackers Target Zimbra Servers in Active Exploitation CampaignSecurityWeek20.08.2026
• Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code ExecutionThe Hacker News20.08.2026
• CERT Polska: Known Flaw in Zimbra Collaboration Suite is Being ExploitedSANS NewsBites17.08.2026