CVE-2026-73570 | ArxDecoded

Zimbra Collaboration Vulnerability Allows Remote Code Execution via SNMP (CVE-2026-73570)

August 26, 2026

Zimbra Collaboration (ZCS) versions prior to 10.1.20 are vulnerable to OS command injection when the optional `zimbra-snmp` package is installed and SNMP notifications are enabled. An unauthenticated attacker can leverage improper input sanitization during SNMP processing to execute arbitrary system commands as the Zimbra user. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.

Zimbra SNMP RCE (CVE-2026-73570) Added to CISA KEV Catalog

August 26, 2026

A critical remote code execution vulnerability affects Zimbra Collaboration when SNMP notifications are enabled. CISA has added it to the Known Exploited Vulnerabilities catalog, and proof-of-concept code is available.