Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

🚨SEVERITY: HIGH — CVSS 8.9Security Advisory

TL;DR 📌

  • Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
  • Highest CVSS: 8.9 (High).
  • Listed in CISA KEV (2026-08-21) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-73570.

What it is

CVE-2026-73570 is an OS command injection vulnerability in Zimbra Collaboration Suite (ZCS), reported by Synacor. The flaw sits in how ZCS handles SMTP requests: a specially crafted SMTP request can trigger execution of arbitrary operating system commands, running as the Zimbra user.

The attack path is unauthenticated and network-based — no credentials or user interaction are needed, and access is via SMTP rather than the administrative interface. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) indicates high attack complexity, but also a scope change, meaning a successful exploit can affect resources beyond the vulnerable component itself. The impact is rated high for confidentiality and integrity, and low for availability, consistent with command execution as the Zimbra service account rather than root.

This CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalogue, added on 2026-08-21, so it is known to be exploited.

What to do

  • Consult the Synacor advisory for fixed releases and apply them as soon as they are available; no fixed version is listed yet, so check back for updates.
  • If your ZCS deployment exposes SMTP to untrusted networks, review and restrict that exposure where operationally possible until a patch is applied.
  • Review mail transfer logs for anomalous or malformed SMTP traffic as a detection measure, given the unauthenticated network attack path.
  • Given the KEV listing, treat remediation as time-sensitive and track it against any applicable KEV-driven patching deadlines your organisation follows.

For leadership 🧭

Executive summary. Zimbra mail servers can be commandeered via a crafted SMTP request without any login, letting an attacker run commands as the Zimbra service account and potentially reach mail data and connected resources. This is already being exploited, so it needs immediate attention rather than being queued for a routine patch cycle.

Why it matters:

  • The attack comes in over SMTP, not the admin console, so any Zimbra server accepting mail from untrusted networks is exposed regardless of admin-panel hardening.
  • No authentication or user interaction is required, and the CVSS scope change means impact can extend beyond the mail process itself into other resources the Zimbra user can touch.
  • Confidentiality and integrity impact is rated high, meaning mailbox data and system configuration are at risk even though the command execution runs as a non-root service account.
  • This CVE is in the CISA KEV catalogue, confirming it is being actively used against Zimbra deployments now, not just theoretically exploitable.

Now / Next / Later:

  • Now: Check whether your Zimbra Collaboration Suite servers accept SMTP from untrusted or internet-wide sources and, where possible, tighten that exposure immediately while a fix is pending.
  • Next: Apply the fixed ZCS release from the Synacor advisory as soon as it is published, and in the meantime review mail transfer logs for anomalous or malformed SMTP traffic.
  • Later: Track this fix against your KEV-driven patching deadlines and build routine monitoring of SMTP-facing services on mail infrastructure into standard operations.

Source