1. Executive summary
CVE-2026-73570 is a HIGH-severity OS command injection vulnerability (CVSS 8.9, CWE-78) in Synacor Zimbra Collaboration Suite (ZCS) versions prior to 10.1.20. The flaw exists in the optional zimbra-snmp package when SNMP notifications are enabled, allowing an unauthenticated attacker to send crafted SMTP requests that execute arbitrary OS commands as the Zimbra user. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalogue on 2026-08-21 with a remediation due date of 2026-08-24, and active exploitation in the wild has been corroborated by CERT Polska. EMEA financial services running internet-facing ZCS instances with SNMP notifications enabled are at immediate risk of unauthenticated remote code execution leading to mailbox compromise and potential data exfiltration.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 19 — reporting of major ICT-related incidents to competent authorities | Active exploitation of an unauthenticated RCE on a customer-facing mail platform (CISA KEV, CERT Polska corroboration) could constitute a major ICT-related incident if compromised. | Clients with affected ZCS instances must be prepared to classify and report an incident under DORA Art. 18/19 if exploitation is confirmed during forensic triage. |
| DORA Art. 24 — digital operational resilience testing — general requirements | The vulnerability is confined to a specific optional configuration (zimbra-snmp installed and SNMP notifications enabled), meaning prior configuration-level testing should have flagged this exposure. |
Clients should incorporate SNMP-notification-enabled configurations into their ICT resilience testing scope going forward. |
No specific NIS2 or UK NIS article is directly engaged beyond general incident-response obligations, as the trigger facts do not differ from any standard vulnerability response.
3. Technical analysis & attack chain
Affected versions: ZCS before 10.1.20. The vulnerability is present only when the optional zimbra-snmp package is installed AND SNMP notifications are enabled.
Vulnerability mechanism: The flaw (CWE-78) arises from improper sanitization of untrusted input during SNMP notification processing. An unauthenticated remote attacker can inject OS commands via specially crafted SMTP requests. The commands execute in the context of the Zimbra user. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L — network-exploitable, no privileges required, no user interaction, but high attack complexity (likely requiring specific payload crafting or timing).
Note on discrepancy: ANSSI France CERT advisory CERTFR-2026-AVI-0844 (07 July 2026) classified this vulnerability as an indirect code injection / XSS. The NVD authoritative record classifies it as CWE-78 (OS Command Injection). Both classifications may describe aspects of the same flaw, but the verified NVD record governs: this is an OS command injection leading to RCE.
Attack chain (confirmed steps)
- Reconnaissance: Attacker identifies an internet-facing ZCS instance running a version prior to 10.1.20 with the
zimbra-snmppackage installed and SNMP notifications enabled. - Initial access: Attacker sends specially crafted SMTP requests to the ZCS server. No authentication is required (PR:N).
- Command execution: The crafted SMTP payload reaches the SNMP notification processing code path. Due to improper input sanitization, attacker-controlled data is passed to OS command execution. Arbitrary commands run as the Zimbra user.
- Post-exploitation: With code execution as the Zimbra user, the attacker can access mailbox data, mail store contents, configuration files, and potentially pivot within the mail infrastructure.
Exploitation status: Active exploitation confirmed by CERT Polska (referenced in CISA-ADP entry). No named threat actor has been identified in the provided source material — attribution is unconfirmed. No ransomware campaign use has been identified (KEV entry states "Unknown").
Confidence caveat: The active-exploitation claim is corroborated by both CISA KEV listing and CERT Polska advisory. Specific exploitation techniques, payloads, and post-exploitation tooling are not detailed in the available sources — these remain single-sourced or absent; verify before enforcement.
4. Mitigation & containment
P1 — Within 24 hours (by 2026-08-24 per CISA KEV)
- Patch immediately: Upgrade ZCS to version 10.1.20 or later. Download from the Zimbra Security Center:
https://wiki.zimbra.com/wiki/Security_Center - If patching is not immediately feasible — disable the attack surface:
- Disable SNMP notifications on the ZCS server.
- Alternatively, remove the
zimbra-snmppackage entirely if SNMP monitoring is not required. - Verify SNMP notification status: check ZCS admin console or run
zmprov gs <server> | grep -i snmpto inspect SNMP-related configuration. - Network containment: Restrict SMTP ingress to known, trusted mail relay IPs only. If the ZCS instance is internet-facing, place it behind a WAF or reverse proxy that can inspect and filter anomalous SMTP payloads. Block or rate-limit SMTP connections from untrusted sources.
- Forensic triage: Per CISA KEV required action, conduct forensics triage on any ZCS instances running versions prior to 10.1.20 with
zimbra-snmpinstalled. Look for: - Unexpected processes running as the Zimbra user.
- Anomalous outbound network connections from the ZCS host.
- Unauthorised modifications to ZCS configuration files or mailboxes.
- Review SMTP logs for malformed or anomalous inbound messages preceding the patch date.
P2 — Within 72 hours
- Inventory and exposure assessment: Identify all ZCS deployments across the estate (including on-premise, hosted, and any third-party-managed instances). For each, confirm: version number, whether
zimbra-snmpis installed, and whether SNMP notifications are enabled. - EDR / monitoring rules: Deploy detection rules for anomalous child processes spawned by the Zimbra mail or SNMP service processes. Monitor for unexpected command execution originating from the ZCS mailbox or SNMP service context.
- Third-party check: If ZCS is operated by an ICT third-party provider, confirm patch status and request written attestation of remediation.
P3 — Within 7 days
- Validate patch deployment: Confirm all ZCS instances are running 10.1.20 or later. Re-enable SNMP notifications only after patching is complete and validated.
- Review SNMP exposure: Assess whether SNMP notifications are operationally necessary. If not, permanently disable and remove the
zimbra-snmppackage to reduce attack surface. - Update asset inventory: Record the
zimbra-snmppackage status as a risk-relevant configuration item in the CMDB.
5. Indicators of compromise
No indicators of compromise available in the source material.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Unexpected OS command execution originating from ZCS SMTP/SNMP processing code paths | EDR process telemetry, audit logs on the ZCS host | Medium — consistent with vulnerability mechanism but no specific IOCs published |
| Anomalous or malformed inbound SMTP messages targeting the ZCS server | SMTP logs, mail gateway logs, network IDS | Medium — attack vector confirmed but specific payload patterns not published |
| Outbound network connections from the ZCS host not associated with normal mail delivery | Network firewall logs, EDR network telemetry | Low — indicative of post-exploitation but not specifically described in sources |
6. Detection
Insufficient indicators to author detection rules.
The source material confirms the vulnerability mechanism (OS command injection via crafted SMTP requests processed through SNMP notification code paths) but does not provide specific payload strings, command-line artefacts, file paths, registry keys, mutex names, or network signatures that could be used to construct reliable YARA or Sigma rules. Deploy behavioural monitoring as described in §5 instead.
CVE assessment
1 referenced CVE — 1 actively exploited (CISA KEV)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-73570 | 8.9 High | ⚠ KEV 2026-08-21 | 1% | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package… |
7. Sources
- NVD — CVE-2026-73570 Detail — https://nvd.nist.gov/vuln/detail/CVE-2026-73570 — 2026-08-21
- CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-73570 entry) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570 — Added 2026-08-21
- CERT Polska — Aktywnie wykorzystywana podatność w Zimbra Collaboration Suite — https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/ — Referenced 2026-08-21
- The Hacker News — Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution — https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html — 2026-08
- ANSSI France CERT — Vulnérabilité dans Synacor Zimbra Collaboration (CERTFR-2026-AVI-0844) — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0844/ — 2026-07-07
- ANSSI France CERT — Multiples vulnérabilités dans Synacor Zimbra Collaboration (CERTFR-2026-AVI-1041) — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1041/ — 2026-08-19
- Zimbra Security Center — https://wiki.zimbra.com/wiki/Security_Center
- Zimbra Security Advisories — https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
8. Adverse Trace position
CVE-2026-73570 is a HIGH-severity (CVSS 8.9) unauthenticated remote code execution vulnerability in a widely deployed enterprise mail platform, with confirmed active exploitation and a CISA KEV remediation deadline of 2026-08-24. The attack surface is narrow — requiring the optional zimbra-snmp package with SNMP notifications enabled — but for EMEA financial services organisations running affected ZCS versions with this configuration, the risk is severe: unauthenticated attackers can achieve arbitrary command execution as the Zimbra user, potentially compromising sensitive mailbox data and mail infrastructure. Clients should patch to 10.1.20 or disable SNMP notifications immediately, conduct forensic triage on exposed instances, and prepare for DORA Art. 19 incident reporting if exploitation is confirmed. Adverse Trace will monitor for emerging IOCs, exploit payloads, and any threat actor attribution, and will update this advisory if actionable detection artefacts become available.
Published via PulseTrace — Adverse Trace threat intelligence.