Is CVE-2026-73570 actively exploited?

Yes. KEV Intelligence tracks CVE-2026-73570 as a known exploited vulnerability. Confidence is high.

What exploitation activity has KEV Intelligence observed?

KEV Intelligence has not yet recorded sensor-observed exploitation attempts for CVE-2026-73570. Our sensors continue to monitor for activity targeting this CVE.

Which versions are affected?

CVE-2026-73570 affects Zimbra Collaboration. Reported affected version: 0 to < 10.1.20.

No. CVE-2026-73570 is not currently listed in CISA KEV.

CVE-2026-73570 Exploited in the Wild — Collaboration

Q: How should organizations remediate it?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Q: Is it in CISA KEV?

No. CVE-2026-73570 is not currently listed in CISA KEV.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-73570 is an unauthenticated vulnerability affecting Zimbra Collaboration. A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is...

Is it exploited?

Yes. KEV Intelligence tracks this CVE as a known exploited vulnerability. Confidence is high.

Who is affected?

Zimbra / Collaboration affected before 10.1.20.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Collaboration Remote Code Execution

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled.

Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Vendor Product Affected Status

Zimbra Collaboration Before 10.1.20 Affected

Published: 13 Aug 2026
Exploitation Reported: 20 Aug 2026
Attack vector: Remote
Complexity: High
Privileges: None
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-73570
wiki.zimbra.com/wiki/Zimbra_Security_Advisories wiki.zimbra.com · CVE Record https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
wiki.zimbra.com/wiki/Security_Center wiki.zimbra.com · CVE Record https://wiki.zimbra.com/wiki/Security_Center

Exploitation evidence

Why KEV Intelligence marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

TheHackerNews

Recorded 20 Aug 2026

Independent exploitation attestation added to the KEV Intelligence record.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the KEV Intelligence Pro API.

Learn about Pro API access

Source	Added
CERT Polska First	2026-08-17 09:01 UTC
TheHackerNews	2026-08-20 13:24 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets: 0
User-Agents: 0

Raw values available in Pro and Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No KEV Intelligence virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

8.9 High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

EPSS

0.5%

Weaknesses

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78

Recent mention · TheHackerNews

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska). The vulnerability in question is CVE-2026-73570 (CVSS score: 8.9), which refers to a case...

Read full advisory

All Mentions

Recent mention · TheHackerNews

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

TheHackerNews · 20 Aug 2026

A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska). The vulnerability in question is CVE-2026-73570 (CVSS score: 8.9), which refers to a case of command injection that can lead to remote code execution. "A remote code execution vulnerability exists in Zimbra

Recent mention · CERT Polska

Aktywnie wykorzystywana podatność w Zimbra Collaboration Suite

CERT Polska · 17 Aug 2026

Zespół CERT Polska informuje o aktywnie wykorzystywanej podatności typu OS Command Injection w Zimbra Collaboration Suite.Podatność, oznaczona jako CVE-2026-73570, pozwala nieuwierzytelnionemu atakującemu na wykonanie dowolnych komend powłoki systemowej z uprawnieniami użytkownika zimbra. Podatność dotyczy instancji posiadających włączoną usługę pułapek SNMP (ang. SNMP trap) za pomocą parametru snmp_notify oraz uruchomioną usługę swatchdog (domyślnie włączona).Podatność została wyeliminowana w wersji 10.1.20.Zalecamy niezwłoczną weryfikację wersji wykorzystywanego przez Państwa...

Timeline

From disclosure to observed exploitation

20 Aug 2026
KEV confirmed by TheHackerNews

Exploitation attested by an external source
17 Aug 2026
Added to KEV Intelligence KEV Feed

High-confidence, third-party attested exploitation
13 Aug 2026
CVE published

Vulnerability disclosed publicly
12 Aug 2026
CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-73570

Free JSON includes basic KEV fields

{
  "cve_id": "CVE-2026-73570",
  "confidence": "High",
  "cvss_score": 8.9,
  "cvss_estimated": false,
  "epss_score": 0.00539,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

CVE-2026-73570

Collaboration Remote Code Execution

CVE References

Exploited in the wild

Known exploited vulnerability sources

Observed signals

Scanner coverage

Virtual patch status

Weaknesses

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

All Mentions

KEV confirmed by TheHackerNews

Added to KEV Intelligence KEV Feed

CVE published

CVE ID reserved

Automate this intelligence

Get alerts on high-impact exploitation