Loading story…
A high-severity remote code execution flaw, tracked as CVE-2026-73570, was disclosed and patched in Zimbra Collaboration versions earlier than 10.1.20. The vulnerability affects deployments where the optional zimbra-snmp package is installed and SNMP notifications are enabled, and stems from improper sanitization of untrusted input during SNMP notification processing, classified as CWE-78.
An unauthenticated attacker could exploit the issue by sending specially crafted SMTP requests, potentially executing arbitrary operating system commands as the Zimbra user. The flaw carries a CVSS v3.1 vector of AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L, while CISA SSVC metadata indicates no known exploitation and non-automatable attack conditions. Italian authorities and vendor guidance urged administrators to update affected systems to version 10.1.20 or later following the published security bulletin.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-73570 was modified to add an SSVC entry from CISA Coordinator stating there was no known exploitation, the flaw was non-automatable, and the technical impact was total.
MITRE received a new CVE record for CVE-2026-73570, a remote code execution vulnerability affecting Zimbra Collaboration before version 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
Security updates were released to fix the high-severity Zimbra Collaboration vulnerability affecting versions earlier than 10.1.20 under the documented zimbra-snmp and SNMP notification conditions. Users were advised to update according to the vendor's security bulletin instructions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourceacn.gov.it
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zimbra released **Zimbra Collaboration Suite 10.1.20** to patch multiple critical and high-severity vulnerabilities affecting its email and collaboration platform, including versions of the **Classic Web Client** prior to `10.1.20`. The most serious issue is a critical unauthenticated command injection flaw in the SNMP monitoring component that could allow arbitrary operating system command execution when SNMP notifications are enabled and the integrated Swatchdog service is running. Zimbra and the Canadian Centre for Cyber Security urged administrators and users to review the advisory and apply the update promptly. The release also fixes four cross-site scripting vulnerabilities in the Classic Web Client, a mail forwarding restriction bypass tracked as **CVE-2026-50055**, an access control flaw in the EWS extension tracked as **CVE-2026-10631**, an authorization issue in mailbox delegation tracked as **CVE-2026-50054**, and a server-side request forgery bug in the Nextcloud integration. Zimbra said customers should update as soon as possible and did not report evidence that the vulnerabilities had been exploited in the wild.
Jul 24, 2026
CISA added **CVE-2025-66376** to its Known Exploited Vulnerabilities catalog after reports of active exploitation against **Zimbra Collaboration Suite**. The high-severity flaw affects the **Classic UI** and lets an unauthenticated remote attacker trigger **stored/persistent XSS** by sending malicious HTML email that abuses the CSS `@import` directive, potentially exposing sensitive information and creating a path to further compromise. The vulnerability affects Zimbra Collaboration Suite versions earlier than **10.0.18** and **10.1.13**. Synacor patched the issue in November 2025, and Zimbra security advisories list the fixed releases; organizations running vulnerable versions have been urged to upgrade immediately to **10.0.18**, **10.1.13**, or later because the flaw is already being exploited in the wild.
Jul 24, 2026
Zimbra Collaboration versions earlier than **10.1.20** were flagged in security advisories warning of vulnerabilities that require vendor-issued updates. The advisory, identified as **`AV26-816`**, prompted national cyber authorities to direct administrators to review Zimbra’s remediation guidance and upgrade affected deployments. The **Canadian Centre for Cyber Security** and **Guyana National CIRT** both urged organizations to assess their exposure, prioritize patching, and apply the available update where necessary. The notices emphasize that systems running unsupported or unpatched Zimbra releases remain at risk until they are brought to **10.1.20** or later in line with the vendor advisory.
Aug 15, 2026