Synacor · Zimbra Collaboration Suite (ZCS)
CVE-2026-73570
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Cos'è
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
CISA: Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Cosa fare
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Scadenza per le agenzie federali USA: 24 agosto 2026
Altre falle sfruttate di Synacor
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 20 apr 2026 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Media 6,1 | 1,7% |
| 18 mar 2026 | Cross-Site Scripting | Zimbra Collaboration Suite (ZCS) | Alta 7,2 | 20% |
| 7 ott 2025 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Media 5,4 | 4,1% |
| 7 lug 2025 | Server-Side Request Forgery (SSRF) | Zimbra Collaboration Suite (ZCS) | Alta 7,5 | 81% |
| 19 mag 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Media 6,1 | 25% |
| 25 feb 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Critica 9,0 | 77% |
| 3 ott 2024 | Command Execution | Zimbra Collaboration Suite (ZCS) | Critica 10,0 | 99,9% |
| 27 lug 2023 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Media 6,1 | 49% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.