AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

🔥 This vulnerability is being actively exploited in the wild (CISA Known Exploited Vulnerabilities catalog)

CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

infovulnerability🔥 Actively Exploited

security

Source: CISA Known Exploited VulnerabilitiesAugust 20, 2026CVE-2026-73570

Summary

Zimbra Collaboration Suite (ZCS) has a critical vulnerability that lets unauthenticated attackers send specially crafted SMTP requests (a protocol for sending emails) to run arbitrary operating system commands with the privileges of the Zimbra user. This vulnerability is currently being exploited in real attacks.

Solution / Mitigation

Apply mitigations in accordance with vendor instructions from Zimbra's security advisories (https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories) and ensure compliance with CISA's BOD 26-04 guidance on prioritizing security updates. Follow BOD 26-04 patching guidelines for your organization's internet-exposed assets, or discontinue use of the product if mitigations are unavailable.

Vulnerability Details

EPSS (30-day exploit probability)

EPSS: 0.5%

Patch Available

Yes

Exploit Maturity

🔥 Actively Exploited

Disclosure Date

August 20, 2026

Classification

Attack SophisticationModerate

Taxonomy References

CWE (Weakness Type)

CWE-78

CAPEC (Attack Pattern)

CAPEC-88

Monthly digest — independent AI security research

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-73570

First tracked: August 21, 2026 at 02:00 PM

Classified by LLM (prompt v3) · confidence: 95%