CISA Adds Zimbra Collaboration Suite OS Command Injection Vulnerability to KEV

What's on the official record

21 August — dateAdded, due 24 August. CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities Catalog; dateAdded 2026-08-21, dueDate 2026-08-24, catalogVersion 2026.10.21. The entry covers Synacor Zimbra Collaboration Suite (ZCS), which contains an OS command injection vulnerability (CWE-78) that could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

The CVE record names Synacor Collaboration before 10.1.20 as affected; the product is fixed in 10.1.20. CISA's requiredAction is to apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 (Prioritizing Security Updates Based on Risk). The catalog does not record known ransomware use (ransomware=Unknown). FIRST's EPSS model estimates EPSS 0.717 (p99, 2026-10-23). CISA's ADP records SSVC exploitation=active, automatable=no, impact=total.

Assessment

For a platform or AI-stack owner, the record lets you check whether any Zimbra Collaboration Suite instance in your estate runs a Synacor Collaboration release before 10.1.20 and accepts SMTP. CISA's ADP records exploitation as active with total impact, which supports patching to 10.1.20 and isolating any instance that cannot yet be upgraded.

For a cyber underwriter, the record lets you ask whether an insured runs ZCS at a Collaboration version before 10.1.20 and whether the fixed release has been applied. CISA's ADP marks exploitation as active with total impact, which supports pricing or requiring a control that verifies patching to 10.1.20 before binding; the catalog does not record known ransomware use.

What would change this call

The call to prioritize patching ZCS instances before 10.1.20 would change if a revised catalogVersion alters the affected or fixed version range, or if the vendor advisory names an additional affected release.

What to check next

Check	Why
Deployed ZCS versions against the 10.1.20 fixed release	Identify instances before 10.1.20 that CISA's catalog flags
Zimbra security advisory for vendor mitigations	CISA's requiredAction points to vendor instructions under BOD 26-04
Current catalogVersion on the KEV catalog page	Confirm no revision since the 2026.10.21 entry

Confidence

Filed 23 October 2026 from the record dated 21 August 2026. The record is drawn directly from the CISA catalog entry, the NVD entry, and the CVE record. No likelihood row is stated because the remediation due date and affected-version questions resolved before the 23 October 2026 filing date.

Sources

[1] Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-73570

[2] CVE record CVE-2026-73570 — https://www.cve.org/CVERecord?id=CVE-2026-73570

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog