CVE-2026-73570

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73570
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73570.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73570
Published
2026-08-13T15:19:42.195Z
Modified
2026-08-27T11:31:14.720771496Z
Severity
  • 8.9 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L CVSS Calculator
Summary
[none]
Details

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73570.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "10.1.20"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "fixed": "10.1.20"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "10.1.20"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "mitre"
}
References

Affected packages

Git
github.com/zimbra/zm-build

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-build
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c33cd93d74564b2fcd6078b564b2e1b4dc9481d3
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.1.20"
        }
    ]
}

Affected versions

10.*
10.1.0
10.1.1
10.1.10
10.1.13
10.1.14
10.1.16
10.1.4
10.1.5
10.1.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73570.json"
github.com/zimbra/zm-zcs

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-zcs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
035c4371687d035685fd572d03a55e6cabf2383c
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.1.20"
        }
    ]
}

Affected versions

10.*
10.0.0
10.0.0-GA
10.1.0
10.1.0.beta
8.*
8.7.10
8.7.11
8.7.6
8.7.7
8.7.9
8.8.0.beta1
8.8.0beta2
8.8.10
8.8.11
8.8.12
8.8.15
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
8.8.7
8.8.8
8.8.9
9.*
9.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73570.json"
github.com/zimbra/zm-zcs-lib

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-zcs-lib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
450d48208970835622dd1b03d981b8d606d40440
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.1.20"
        }
    ]
}

Affected versions

10.*
10.0.0
10.0.0-GA
10.1.0
10.1.1
10.1.13
10.1.14
10.1.4
8.*
8.7.10
8.7.11
8.7.6
8.7.7
8.7.9
8.8.0.beta1
8.8.10
8.8.11
8.8.12
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
8.8.7
8.8.8
8.8.9
9.*
9.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73570.json"