CVE entry · CVE-2026-73570
CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
- Actively exploited: added to CISA’s KEV catalog on August 21, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: August 24, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Synacor Zimbra Collaboration Suite (ZCS), including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (wiki.zimbra.com)
- Vendor advisory or reference cited by CISA (blog.zimbra.com)
- NVD entry (NIST)
- CISA KEV catalog
Other Synacor vulnerabilities
-
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
-
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
-
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
-
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
-
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability