Vulnerability intelligence

CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

CVSS Score

8.9

High

EPSS — Exploit Probability

0.5%

Riskier than 43% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Aug 20, 2026 · latest Aug 20, 2026

Coverage timeline

Zimbra flaw (CVE-2026-73570) lets attackers run arbitrary code
securityonline.info · Aug 20, 2026