Zimbra Collaboration Suite (ZCS) Remote Code Execution Vulnerability Advisory (CVE-2026-73570, CISA KEV Listed)

1. Apply Official Security Patch

Upgrade your Zimbra Collaboration Suite instance to version 10.1.20 or later as recommended by the vendor.

2. Temporary Mitigation (If patching cannot be applied immediately)

Disable the vulnerable SNMP component to block the attack vector.

A. Stop and Disable zimbra-snmp Service Log in as the zimbra user and execute the following commands to stop and disable the SNMP service:

# Switch to zimbra user
su - zimbra

# Stop the SNMP service
zmsnmpstatusctl stop

# Disable the service from starting automatically
zmprov ms $(zmhostname) -zimbraServiceEnabled snmp

B. Remove the Package (Optional) Remove the package using your operating system's package manager.

• For Ubuntu/Debian:

  sudo apt-get remove zimbra-snmp

• For RHEL/CentOS:

  sudo yum remove zimbra-snmp

This vulnerability (CVE-2026-73570) is a critical OS Command Injection (CWE-78) vulnerability affecting Zimbra Collaboration Suite (ZCS).

Root Cause: The issue resides in the processing of SNMP notifications within the optional zimbra-snmp package. When SNMP notifications are enabled, the application fails to properly sanitize untrusted input received from external sources.

Exploit Mechanics:

• An unauthenticated attacker sends a specially crafted SMTP request to the target Zimbra server.
• During the processing of the SNMP notification triggered by the request, the unsanitized input is passed directly to a system shell.
• This allows the attacker to execute arbitrary operating system commands under the privileges of the zimbra user.

Impact & Severity: With a CVSS score of 8.9 (High) and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat. Successful exploitation can lead to full compromise of the mail server, unauthorized access to sensitive communications, and lateral movement within the enterprise network.