CVE-2026-73570Vulnerability

Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on 21 Aug 2026.

Reported by 8 independent sources · first reported 8 Sep 2026 by Recorded Future · last reported 23 Oct 2026

Last reported yesterday

CISA KEVAdded 21 Aug 2026
Fix due 24 Aug 2026
Used by ransomware: not knownCISA KEV catalogue

EPSS71.7%
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026

What the reports say

8 reports, newest first · the exact sentence from each

“How CVE-2026-73570 turns a Zimbra log file into remote code execution”

Elastic Security LabsVendor23 Oct 2026
How CVE-2026-73570 turns a Zimbra log file into remote code execution
“CVE-2026-73570: Zimbra Mail Server Flaw Exploited in Active Attacks”

Silent PushVendor2 Oct 2026
Weekly Cybersecurity Roundup: How Stolen Credentials Continue to Fuel Fraud
“Microsoft Threat Intelligence said it tracked exploitation of CVE-2026-73570, an unauthenticated command injection vulnerability in Zimbra Collaboration Suite that gives attackers a potentially easy route into exposed mail servers.”

The Register (security)News1 Oct 2026
Microsoft catches hackers exploiting Zimbra bug before disclosure
“Tracked as CVE-2026-73570 (CVSS score of 8.9), the flaw exists because, in ZCS before 10.1.20, untrusted input during SNMP notification processing is improperly sanitized.”

SecurityWeekNews1 Oct 2026
Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure
“The attack exploits CVE-2026-73570 (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol (SNMP) notifications are enabled and the optional zimbra-snmp package is installed.”

The Hacker NewsNews30 Sep 2026
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
“Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570”

Microsoft Security BlogVendor30 Sep 2026
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
“CVE-2026-73570, unauthenticated command injection through SNMP notification handling.”

Rapid7Vendor24 Sep 2026
When Business Email Compromise Starts Rewriting Reality
“CVE-2026-73570”

Recorded FutureVendor8 Sep 2026
August 2026 CVE Landscape

Indicators reported together

named in the same reports

hxxps://aka[.]ms/downloadazcopy-v10-linuxin 2 reports
wsweb03.blob.core.windows[.]netin 2 reports

Copy these 2 indicators · defanged

2 indicators, defanged, one per line

hxxps://aka[.]ms/downloadazcopy-v10-linux
wsweb03.blob.core.windows[.]net

Also named with it: CVE-2022-27925, CVE-2025-49113, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2026-0300, CVE-2026-33017, CVE-2017-0199, CVE-2022-0847, CVE-2026-34486, CVE-2026-39987, CVE-2026-63030, CVE-2021-3156, CVE-2021-29441, CVE-2026-3055, CVE-2026-12569

Thanks — we review every report.

Report a wrong value