Synacor · Zimbra Collaboration Suite (ZCS)
CVE-2026-73570
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Qué es
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
CISA: Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Qué hacer
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Plazo para las agencias federales de EE. UU.: 24 de agosto de 2026
- Añadida a la lista de CISA
- 21 de agosto de 2026
- Publicada
- 13 de agosto de 2026
- Gravedad
- Alto 8,9 CVSS 3.1
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 72% entre el 0,6% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-78
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (2)
Más fallos explotados de Synacor
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 20 abr 2026 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Media 6,1 | 1,7% |
| 18 mar 2026 | Cross-Site Scripting | Zimbra Collaboration Suite (ZCS) | Alto 7,2 | 20% |
| 7 oct 2025 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Media 5,4 | 4,1% |
| 7 jul 2025 | Server-Side Request Forgery (SSRF) | Zimbra Collaboration Suite (ZCS) | Alto 7,5 | 81% |
| 19 may 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Media 6,1 | 25% |
| 25 feb 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Crítica 9,0 | 77% |
| 3 oct 2024 | Command Execution | Zimbra Collaboration Suite (ZCS) | Crítica 10,0 | 99,9% |
| 27 jul 2023 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Media 6,1 | 49% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.