A remote code execution vulnerability affecting Zimbra Collaboration versions < 10.1.20 when the SNMP notification handling does not sanitize untrusted input, allowing an unauthenticated attacker to send specially crafted requests and execute arbitrary OS commands as the zimbra user. This flaw poses a significant business impact due to its exploitation in the wild by attackers targeting Zimbra, which runs email for governments, universities, and firms worldwide. The vulnerability, identified as CVE-2026-73570 with a CVSS score of 8.9, is classified as a remote code execution flaw that can be exploited through an attack vector involving unauthenticated requests to the vulnerable system. This type of vulnerability has a high business impact due to its potential for widespread exploitation and the sensitive nature of the data handled by Zimbra.
We recommend you to update Zimbra Collaboration to version 10.1.20.[/subscribe_to_unlock_form]
A remote code execution vulnerability affecting Zimbra Collaboration versions < 10.1.20 when the SNMP notification handling does not sanitize untrusted input, allowing an unauthenticated attacker to send specially crafted requests and execute arbitrary OS commands as the zimbra user. This flaw poses a significant business impact due to its exploitation in the wild by attackers targeting Zimbra, which runs email for governments, universities, and firms worldwide. The vulnerability, identified as CVE-2026-73570 with a CVSS score of 8.9, is classified as a remote code execution flaw that can be exploited through an attack vector involving unauthenticated requests to the vulnerable system. This type of vulnerability has a high business impact due to its potential for widespread exploitation and the sensitive nature of the data handled by Zimbra.
We recommend you to update Zimbra Collaboration to version 10.1.20.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]