CVE-2026-73570
Description
CVE-2026-73570 is a high-severity RCE vulnerability in Zimbra Collaboration Suite (ZCS) affecting versions prior to 10.1.20. Patch immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| zimbra_collaboration_suite | * | 10.1.20 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately download and install the security patches provided by Synacor for Zimbra Collaboration Suite. Ensure the zimbra-snmp package is updated to the latest version to address the improper input sanitization flaw.
Update affected systems
Upgrade all Zimbra Collaboration Suite (ZCS) instances to version 10.1.20 or later. This version removes the vulnerability by properly sanitizing untrusted input during SNMP notification processing.
Restrict access
If patching cannot be performed immediately, disable the optional zimbra-snmp package or restrict SMTP traffic to known, trusted mail relays. Use firewalls to limit access to management interfaces and SNMP services.
Monitor for exploitation
Audit system process logs for unexpected shell activity (e.g., /bin/sh or /bin/bash) initiated by the Zimbra user. Monitor SMTP logs for suspicious payloads or unusual command strings that deviate from standard mail traffic.
Detection Guidance
"Detection should focus on identifying anomalous command execution originating from the Zimbra service. Monitor audit logs for the zimbra-snmp process spawning unexpected child shells. Search SMTP logs for requests containing shell metacharacters like backticks, semicolons, or pipes. Additionally, implement network signatures to detect outbound connections from the Zimbra server to unknown external IPs, which may indicate a successful reverse shell or data exfiltration attempt following exploitation."