What Happened (Plain English)
High-risk Zimbra Collaboration weakness requires patching (CVE-2026-73570) affects Zimbra Collaboration. FIRST EPSS telemetry places exploitation probability at 76.62%. With a CVSS score of 8.9 (HIGH), security teams should verify affected deployments and prioritize remediation according to exposure.
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. Unpatched internet-facing or user-accessible instances risk unauthorized execution, data exposure, or service disruption.
Affected Software & Weakness
Vendor: Zimbra · Product: Collaboration · Versions: Collaboration 0 · CWE: CWE-78
The Fix
Verify your installed Collaboration version against Zimbra's official security bulletin for CVE-2026-73570, apply the patched build in a staging ring first when possible, and confirm rollout across all production nodes.
Temporary Workarounds
If patching Zimbra Collaboration cannot happen today, place management ports behind VPN or zero-trust access, restrict untrusted network ingress, and enforce multi-factor authentication on administrative sessions.
Detection & Log Checks
Inspect Collaboration application logs, perimeter firewall denies/allows, and EDR process trees for unusual child processes or outbound connections correlated with CVE-2026-73570 (CWE-78).
Frequently Asked Questions
Is CVE-2026-73570 actively exploited?
No KEV listing yet, but EPSS exploitation probability is 76.62%.
What is the fix for CVE-2026-73570?
Upgrade Collaboration to >= 10.1.20 (CVE-2026-73570 vendor patch).
Which Zimbra products are affected?
Zimbra Collaboration (Collaboration 0).
How urgent is patching CVE-2026-73570?
Priority queue: THIS-WEEK (CVSS 8.9, EPSS 76.62%).
Official References
Last verified: 2026-11-13 · Defensive checklist only.