ZeroDayAlert

CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Synacor Zimbra Collaboration Suite (ZCS) Added to KEV 2026-08-21 Federal due 2026-08-24 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Zimbra Collaboration Suite (ZCS) deployments running any version containing this OS command injection vulnerability are at risk. The vulnerability allows unauthenticated attackers to inject arbitrary operating system commands via specially crafted SMTP requests, which execute with the privileges of the Zimbra system user. The record does not specify which versions are affected, nor does it identify affected platform combinations (Linux distributions, deployment models, or cloud versus on-premises configurations).

How to check whether this touches you

  • Inventory your messaging and collaboration infrastructure: confirm whether you operate any Zimbra Collaboration Suite instances.
  • Establish network reachability: determine whether your ZCS SMTP services are directly accessible from untrusted networks, including the internet, or protected by perimeter controls.
  • Check service fingerprinting: query the SMTP port (typically 25, 587, or 465) for banner information; Zimbra typically identifies itself in responses, though this is a signal only—not definitive confirmation.
  • Contact your Zimbra vendor or check vendor advisories for the specific version numbers and build dates deployed in your environment, as the record does not enumerate affected versions.

What to do

  1. Immediately assess internet exposure: identify all ZCS SMTP endpoints reachable from untrusted networks and document their current network position (DMZ, cloud provider, on-premises behind firewall, etc.).
  2. Apply vendor mitigations without delay: Synacor will publish patch and mitigation guidance; retrieve and follow their instructions precisely, ensuring alignment with CISA BOD 26-04 timelines (federal systems have a due date of 26 August 2026).
  3. If patching is unavailable or delayed: restrict SMTP inbound access to trusted IP ranges, implement rate limiting on SMTP connections, and monitor for exploitation attempts (see logging guidance below).
  4. Enable command-level logging: ensure your ZCS logs capture SMTP transaction details and any system command execution; retain logs for at least 90 days to support incident investigation.
  5. For cloud-hosted ZCS: if your cloud provider cannot guarantee patching or mitigations within your risk tolerance, escalate to your information security lead and business stakeholders to evaluate discontinuation of the service in line with BOD 26-04.

If you find you were exposed

Exploitation of OS command injection vulnerabilities typically occurs before public disclosure is announced. Review your SMTP access logs and system command audit trails (if available) for the period from at least 60 days before this CISA advisory back to your earliest retained logs, searching for unusual SMTP source IPs, malformed requests, or unexpected system commands executed by the Zimbra user account. If your log retention window is shorter than 60 days, document the gap and extend retention immediately. Engage your forensics or incident response team to extract and analyse any artifacts from backups or file-system snapshots if live logs are insufficient.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-73570 is being exploited. It cannot tell you whether Zimbra Collaboration Suite (ZCS) is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →