DaystoPatch

Zimbra (Synacor)Exploited incident

Zimbra SNMP notification command injection (CVE-2026-73570)

CVE-2026-73570High, CVSS 8.9In CISA's Known Exploited Vulnerabilities catalog since 21 Aug 2026

  • Exploited after a fix existed
FixedFixed for every supported version 13 days after the first public report.

Response

Silence
same day
First public report to first vendor statement
Exposure
13d
First public report to first fix
Follow-through
13d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Zimbra Releases/10.1.19 release notes (Wayback capture 2026-07-07 13:05 UTC)CuratedQuote verified

    please follow the updated SNMP mitigation steps provided in the Security Advisory after completing the upgrade.

    First public signal found: the 10.1.19 release notes ('Release Date: July 7, 2026') tell customers about 'the SNMP mitigation' and 'the Security Advisory', i.e. a known SNMP security issue without a fix. The advisory and mitigation themselves were not public (see notes).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:802cbb02a2106d69…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    Zimbra blog: Patch Release Update: Zimbra 10.1.20CuratedQuote verified20 Jul 2026

    By marilyn lee on July 20, 2026

    First public description of the bug that could be retrieved: the 10.1.20 release post lists 'A command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled.' (article:published_time 2026-07-20T09:15:40+00:00).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8edbbeef2a91849c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-73570ClaimedQuote verified13 Aug 2026, 15:19 UTC

    A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:fe67d5cf09df281d…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet13 Aug 2026, 17:00 UTC

    🟠 CVE-2026-73570 - High (8.9)

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet20 Aug 2026, 09:55 UTC

    12,100 exposed servers worldwide at risk, with most located in Europe and Asia. Attackers can exploit this flaw, tracked as CVE-2026-73570, to execute remote code without authentication, simply by sending specially crafted SMTP requests. https:// osintsights.com/zimbra-vulnera bility-exploited-in-

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-73570)ClaimedQuote verified21 Aug 2026

    Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

    Added to CISA's KEV catalog on 2026-08-21.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Zimbra Releases/10.1.19 release notes (Wayback capture 2026-07-07 13:05 UTC)CuratedQuote verified

    If the SNMP mitigation has already been applied on your existing 10.1.x deployment, it will remain effective after upgrading to

    Zimbra's first public acknowledgement found (release notes dated 'Release Date: July 7, 2026'); details of the bug were first described publicly in the 10.1.20 notes of 2026-07-20.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:802cbb02a2106d69…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Zimbra blog: Patch Release Update: Zimbra 10.1.20CuratedQuote verified20 Jul 2026

    By marilyn lee on July 20, 2026

    First public Zimbra text describing the bug that we could retrieve (article:published_time 2026-07-20T09:15:40+00:00).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8edbbeef2a91849c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date only+13d

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.1.20 was released on Mon Jul 20 2026.

    Entry lists 'Fixed a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled.' The Zimbra Security Advisories table maps this fix to CVE-2026-73570, fixed in 10.1.20. wiki.zimbra.com was in maintenance on 2026-10-22, so Wayback captures are cited.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date only+13d

    Zimbra Security Advisories table (Wayback snapshot)CuratedQuote verified

    Fixed a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled.

    The table row lists only 10.1.20 as the fix release, and the page says only supported versions are referenced; no other supported branch is listed for this CVE. Date from the Security Center entry for 10.1.20 (2026-07-20).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3509ebd6fdc561ce…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Zimbra Collaboration Suite before 10.1.20 with zimbra-snmp installed and SNMP notifications enabled
How we built this timeline

Correction pass 23 Oct 2026 (coordinator item 3, high risk): the 26 Jun 2026 advisory was searched for and found to be customer-only. Searched: Wayback captures of wiki.zimbra.com Security_Center (9 Jul 2026) and Zimbra_Security_Advisories (9 Jul 2026, 12 Jul 2026), Zimbra's advisory feed (only a 11 Jun 2026 capture) and blog feed (12 Jul 2026): no SNMP entry before 10.1.20; the Zeta Alliance users list (June/July 2026 archives): nothing;

NVD and CVE references: only the Security Center, the advisories table, CERT Polska and KEV; BleepingComputer, SecurityWeek, The Hacker News, Help Net Security: all date disclosure from 10.1.20 or CVE publication (13 Aug 2026); forums.zimbra.org and wiki.zimbra.com were offline for maintenance on 22 Oct 2026/23.

Evidence that the advisory was not public: in the forum thread for 10.1.19 (Wayback capture 12 Jul 2026), user 'ghen' wrote on 'Wed Jul 08, 2026 9:41 am': 'I find it quite puzzling btw, that the 10.1.19 release wiki page is referring to "the SNMP mitigation", which was communicated only to customers and marked "highly confidential"?' Microsoft Threat Intelligence (30 Sep 2026) also says 'CVE-2026-73570 was publicly disclosed on August 13, 2026'. Zimbra's 10.1.20 post calls 10.1.20 a 'Permanent fix for the vulnerability disclosed in our security advisory on 26th June 2026'.

One secondary site (Decryption Digest) states 'June 26, 2026: Vulnerability initially disclosed; temporary mitigation guidance published', without a link. Result: 26 Jun 2026 is not recorded as world, vendor or workaround, because private customer notices do not count and the mitigation text was never public.

The earliest public signal is the 10.1.19 release notes (7 Jul 2026), which mention 'the SNMP mitigation' and 'the Security Advisory'. World and vendor therefore move from 20 Jul 2026 to 7 Jul 2026, and exposure from 0 to 13 days.

If the integrator decides customer-only advisories should count, world, vendor and workaround would be 26 Jun 2026 (about 24 days of exposure). Exploitation was seen only after the fix (R4: false): Microsoft: 'Between July 28 and August 7, after a fix became available on July 20 but before public disclosure on August 13, Microsoft observed two distinct out-of-band scanning tools probing the vulnerable injection point.' CERT Polska alert 145/2026 (17 Aug 2026) reports active exploitation.

Zimbra's advisories table lists only 10.1.20 as the fix and says only supported versions are referenced (R6); the 10.1.19 notes mention customers on 10.0.x, 9.0.x and 8.8.15 only as upgrading to 10.1. The reporter credited by Zimbra is a SOC ('Vatican City State Governorate - DIRTLCSSII - SOC').

CVSS 8.9 from the CVE record (MITRE CNA; Zimbra lists 'TBD').

Related

No related incidents.

Zimbra (Synacor) report card