Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

Synacor Zimbra Collaboration Suite (ZCS)

Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. Added to CISA KEV on 2026-08-21 (federal deadline 2026-08-24).

First seen: 21 Aug 2026
Last update: 21 Aug 2026, 12:00 UTC
Identifiers: CVE-2026-73570
Source: CISA KEV
On the menu as: Enterprise apps

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Synacor Zimbra Collaboration Suite (ZCS)
Ids: CVE-2026-73570

Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. Added to CISA KEV on 2026-08-21 (federal deadline 2026-08-24).

## Steps
1. This touches infrastructure (erp). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-73570") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/ https://nvd.nist.gov/vuln/detail/CVE-2026-73570 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://pwned.coffee/i/synacor-zimbra-collaboration-suite-zcs-zimbra-collaborat-cve-2026-73570

Sources

Totalone hot coffee