JPCERT/CC's Weekly Report highlights a critical OS command injection vulnerability in Zimbra Collaboration (CVE-2026-73570). The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation and added this flaw to its Known Exploited Vulnerabilities (KEV) catalog.
The vulnerability is not universally present in all Zimbra deployments. According to the supporting OSV record, the issue exists in Zimbra Collaboration (ZCS) versions prior to 10.1.20, but only when two specific conditions are met:
- The optional
zimbra-snmppackage is installed. - SNMP notifications are enabled.
When these conditions are present, improper sanitization of untrusted input during SNMP notification processing allows an unauthenticated attacker to send specially crafted SMTP requests. This can result in the execution of arbitrary operating system commands under the privileges of the Zimbra user.
JPCERT/CC has confirmed that proof-of-concept (PoC) code for this vulnerability is publicly available. Given the availability of exploit code and CISA's inclusion of the CVE in the KEV catalog, administrators are advised to prioritize patching.
Remediation
Updating Zimbra Collaboration to version 10.1.20 or later resolves the issue. If the zimbra-snmp package is not required, administrators may also consider disabling SNMP notifications to mitigate the risk.