A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

This RCE affecting Zimbra Collaboration Suite has been reportedly exploited in the wild. Urgent patching is recommended to protect from this threat.

According to its banner, the version of Zimbra Collaboration running on the remote host is prior to 10.1.20. It is, therefore, affected by a Remote Code Execution due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, Zimbra Collaboration Server is affected by multiple vulnerabilities, including:

  - A remote code execution vulnerability exists when the optional zimbra-snmp package is installed and SNMP     notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an     unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary     operating system commands as the Zimbra user. (CVE-2026-73570)

  - A security issue in the EWS extension related to access controls. (CVE-2026-10631)

  - An authorization issue in mailbox delegation. (CVE-2026-50054)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115444	Zimbra Collaboration < 10.1.20 Remote Code Execution	Web App Scanning	Component Vulnerability	Version Based	high
329328	Zimbra Collaboration Server 10.1.x < 10.1.20 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	high

Detections

Analytics

CVE-2026-73570

high

Tenable Plugins

high

high