Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

🚨SEVERITY: HIGH — CVSS 8.9Security Advisory

TL;DR 📌

  • Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
  • Highest CVSS: 8.9 (High).
  • Listed in CISA KEV (2026-08-21) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-73570.

What it is

CVE-2026-73570 is an OS command injection vulnerability in Zimbra Collaboration Suite (ZCS), reported by Synacor. The flaw sits in how ZCS handles SMTP requests: a specially crafted SMTP request can trigger execution of arbitrary operating system commands, running as the Zimbra user.

The attack path is unauthenticated and network-based — no credentials or user interaction are needed, and access is via SMTP rather than the administrative interface. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) indicates high attack complexity, but also a scope change, meaning a successful exploit can affect resources beyond the vulnerable component itself. The impact is rated high for confidentiality and integrity, and low for availability, consistent with command execution as the Zimbra service account rather than root.

This CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalogue, added on 2026-08-21, so it is known to be exploited.

What to do

  • Consult the Synacor advisory for fixed releases and apply them as soon as they are available; no fixed version is listed yet, so check back for updates.
  • If your ZCS deployment exposes SMTP to untrusted networks, review and restrict that exposure where operationally possible until a patch is applied.
  • Review mail transfer logs for anomalous or malformed SMTP traffic as a detection measure, given the unauthenticated network attack path.
  • Given the KEV listing, treat remediation as time-sensitive and track it against any applicable KEV-driven patching deadlines your organisation follows.

For leadership 🧭

Executive summary. Risk is High (CVSS 8.9) across any Synacor kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source