# CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

- Exploited (CISA KEV): yes, added 2026-08-21
- Published: 2026-08-13
- CVSS: 8.9 HIGH (v3.1)
- EPSS: 71.7% (99th percentile)
- CWE: CWE-78

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

1 posts seen since 2026-11-03.

- x 2026-11-03: Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 #UAE #Microsoft #CyberSecurity https://t.co/9PKsiEc8T7 (https://x.com/Tech1UAE/status/2117456666862268704)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-73570 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-73570