THE U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in the Zimbra Collaboration Suite (ZCS), identified as CVE-2026-73570, to its Known Exploited Vulnerabilities catalog. This flaw allows unauthenticated remote code execution and has been actively exploited by threat actors. The vulnerability affects systems with SNMP trap service enabled and allows attackers to execute shell commands with user privileges.
Zimbra released a patch 28 days before the vulnerability was confirmed to be exploited. CISA has mandated that federal agencies must address this vulnerability by August 24, 2026, while private organizations are also urged to review the vulnerabilities and take necessary actions.