CVE-2026-73570

An unauthenticated attacker can execute arbitrary OS commands via crafted SMTP requests in Zimbra Collaboration Suite due to an OS command injection flaw.

This OS command injection vulnerability allows remote code execution without authentication, enabling attackers to compromise mail servers and pivot to other systems. DIB organizations must ensure Zimbra is patched immediately and monitor for exploitation attempts, as this flaw is actively exploited in the wild and represents a severe compliance risk under NIST 800-171 for unpatched critical vulnerabilities.

Shame score — The vulnerability is actively exploited in the wild, allowing unauthenticated remote code execution, and reflects a chronic failure to patch critical flaws in a widely deployed platform.