CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog on August 21, 2026 and set August 24 as the remediation due date. That deadline is mandatory for affected Federal Civilian Executive Branch systems under Binding Operational Directive 26-04. Other organizations should treat the KEV listing as urgent guidance, but the directive does not make the deadline binding on them.
TL;DR
- -CISA added CVE-2026-73570, a CVSS 8.9 OS Command Injection flaw in Zimbra Collaboration Suite, to the KEV catalog on August 21, 2026, with active exploitation confirmed.
- -Federal civilian agencies under BOD 26-04 must remediate or discontinue use by August 24, 2026; the mandatory deadline does not extend to other organizations.
- -Only ZCS installations running versions before 10.1.20 with zimbra-snmp installed and SNMP notifications enabled are affected; Zimbra addressed the flaw in version 10.1.20.
What Changed
The vulnerability affects Synacor Zimbra Collaboration Suite versions before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. It is an OS Command Injection flaw classified under CWE-78.
An unauthenticated attacker can send specially crafted SMTP requests that may execute operating system commands as the Zimbra user. MITRE assigned the flaw a CVSS 3.1 base score of 8.9 HIGH. The attack is network-based and requires no privileges or user interaction, though attack complexity is rated high.
Details
CISA's KEV entry directs affected federal agencies to apply vendor mitigations under BOD 26-04 and follow CISA's forensics triage requirements. If mitigations are unavailable, agencies must discontinue use of the product. The entry also directs stakeholders to evaluate each asset's internet exposure.
Zimbra addressed the flaw in version 10.1.20. Organizations are affected only when they run an earlier version with zimbra-snmp installed and SNMP notifications enabled. CISA lists known use in ransomware campaigns as unknown, although KEV inclusion confirms active exploitation.
Scope and Context
The three-day remediation window applies to affected federal civilian systems. Other organizations are not bound by BOD 26-04, but CISA recommends using the KEV catalog to prioritize vulnerability management.
The flaw arrives amid elevated threats involving ZCS. In July 2026, a joint advisory warned ZCS users about campaigns by the Russian state-supported group known primarily as LAUNDRY BEAR. The group has been targeting Western government and commercial organizations using ZCS since at least July 2025.
That advisory covered a separate vulnerability, CVE-2025-66376, patched in November 2025. It enabled email exfiltration after viewing a malicious message in a vulnerable ZCS webmail service. CVE-2026-73570 has a different exploitation path, and CISA's KEV entry does not attribute it to a specific threat actor.
Related service: Custom Software Engineering
Sources and supporting resources
- CISA Adds CVE-2026-73570 Affecting Synacor Zimbra Collaboration Suite (ZCS) to Its KEV Catalog
- Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite | CISA
- CISA, NSA, FBI and Partners Warn Zimbra Collaboration Suite Users of Ongoing Russian State-Supported Malicious Threat Activity | CISA
- Known Exploited Vulnerabilities Catalog | CISA