OS command injection in Zimbra reached over SMTP — what it means when one product appears in KEV again and again
Zimbra Collaboration Suite contains an OS command injection vulnerability. An unauthenticated attacker sending specially crafted SMTP requests could execute arbitrary operating system commands as the Zimbra user. It was added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-21 with a due date three days later.
Key facts
- CVE IDCVE-2026-73570
- Affected (vendor / product)Synacor Zimbra Collaboration Suite (ZCS)
- CWECWE-78
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-08-24 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Zimbra Collaboration Suite contains an OS command injection (CWE-78) exploitable without authentication.
- Specially crafted SMTP requests could cause execution of arbitrary operating system commands as the Zimbra user.
- Added to KEV on 2026-08-21 with a due date of 2026-08-24, a three-day grace period.
- Among the 1,687 records this site holds as of 2026-09-02, Zimbra Collaboration Suite accounts for 17 — the same count as Exchange Server.
- There are 680 distinct product names at that date, led by Windows with 172 and Multiple Products with 79.
1The port that accepts mail becomes the way in
A mail server is placed on the assumption that unknown parties will connect to it from outside. SMTP is the procedure for receiving, and refusing to accept is not an option. This entry concerns OS command injection in that receiving path: a crafted request can have part of its content interpreted as a command on the server and run with the privileges of the Zimbra user. No authentication is required, so anyone able to send is in position to try.
2When the same product keeps appearing
Counting the records by product name, Zimbra Collaboration Suite comes to 17. With 680 distinct product names in the catalog, a product appearing repeatedly means something. One part is that the product faces outward and makes an attractive target. The other is that many organizations run it, so exploitation is more readily observed. Sitting level with Exchange Server also reflects the shared position of a mail platform.
3The limit and the danger of running as the service user
The record states that execution occurs with the privileges of the Zimbra user. That is not administrator itself, but the range a mail server process can read and write is broad, reaching stored mail, configuration and material used for authentication. Combining it with a technique for raising privileges from there is not unusual. The constraint at the first stage cannot be treated as a ceiling on the damage.
4A three-day grace period
The due date is three days after the addition. Across the 1,687 records this site holds as of 2026-09-02, grace periods have a median of 21 days, a minimum of 1 and a maximum of 184, placing this among the shorter ones. That the path is reachable from outside without authentication reads as being reflected in the instruction.
The required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use. Verify applicability with official vendor information and your own environment.
Why it matters
A mail platform that must accept outside connections turns the speed of applying known fixes directly into its defense. That one product appears in KEV repeatedly is grounds for securing an update path for it in normal times.
FAQ
Can closing SMTP prevent this?
If it runs as the service user, is the damage limited?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).