Skip to content
Zimbra CVE-2026-73570: Unauthenticated RCE via Command Injection

Zimbra CVE-2026-73570: Unauthenticated RCE via Command Injection

First seen 23 Oct 2026, 19:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 20:43 UTC
  • •CVE-2026-73570 allows unauthenticated RCE in Zimbra via crafted SMTP messages.
  • •The vulnerability affects Zimbra versions prior to 10.1.20, patched on 2026-10-21.
  • •Public PoCs were released on 2026-08-21, indicating active exploitation risks.

CVE-2026-73570 is a high-severity unauthenticated command injection vulnerability in Zimbra, allowing remote code execution (RCE) through crafted SMTP messages. Exploiting this flaw enables attackers to execute commands as the zimbra user, potentially compromising email accounts and identity management. The vulnerability affects Zimbra Collaboration Suite versions prior to 10.1.20, which was patched on 2026-10-21. Public proofs of concept (PoCs) for this vulnerability were released on 2026-08-21, and it has been since being added to the CISA KEV list. Organizations using unpatched Zimbra versions are urged to upgrade immediately to mitigate the risk of exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-21
CVE-2026-73570 added to CISA KEV
CISA included CVE-2026-73570 in its Known Exploited Vulnerabilities catalog due to active exploitation.
Elastic.Co
2026-08-21
First public PoC released
Public proofs of concept for CVE-2026-73570 were made available, demonstrating the exploit chain.
Pruva.dev
2026-10-21
Zimbra patch released
Zimbra released version 10.1.20, which addresses CVE-2026-73570, mitigating the vulnerability.
Elastic.Co
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (3)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 4

Common questions

What versions of Zimbra are vulnerable?
Zimbra Collaboration Suite versions prior to 10.1.20 are affected by CVE-2026-73570.
How urgent is the need to patch?
It is critical to patch to version 10.1.20 or later immediately to prevent exploitation.
What does the exploit allow an attacker to do?
The exploit allows attackers to execute arbitrary commands as the zimbra user, potentially compromising email accounts.