CISA has added CVE-2026-73570 to its Known Exploited Vulnerabilities catalogue. The flaw affects Synacor’s Zimbra Collaboration Suite (ZCS) and is an OS command injection vulnerability that allows an unauthenticated attacker to execute arbitrary operating system commands via specially crafted SMTP requests.
The vulnerability resides in the ZCS SMTP handling component and can be exploited remotely without any authentication. By sending malformed SMTP commands, an attacker can inject and execute OS‑level commands under the privileges of the Zimbra service account, potentially leading to full system compromise. The CVSS v3.1 base score for this issue is 8.9, which rates it as High. No patch is currently listed in the NVD entry, and the vendor has not released an advisory that is publicly referenced.
CISA’s inclusion indicates that active exploitation of CVE-2026-73570 has been observed in the wild. No ransomware campaign has been publicly linked to this vulnerability at this time. Federal Civilian Executive Branch agencies must apply the required mitigations by 24 August 2026.
CISA requires Federal Civilian Executive Branch agencies to apply mitigations in accordance with vendor instructions, ensure compliance with BOD 26‑04 Prioritizing Security Updates Based on Risk and the Forensics Triage Requirements, and either follow applicable BOD 26‑04 guidance for cloud services or discontinue use of the product if mitigations cannot be applied. Stakeholders must evaluate each asset’s internet exposure and adhere to BOD 26‑04 patching guidelines. All other organisations should review their Zimbra deployments for exposure and apply any available mitigations as soon as possible.
For full details, see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-73570 and the CISA KEV catalogue.