Zimbra Multiple Vulnerabilities
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
CSIRTS triage
- What
- Multiple vulnerabilities exist in Zimbra allowing remote code execution, authentication bypass, privilege escalation, and information disclosure.
- Who is affected
- All Zimbra deployments running affected versions.
- Urgency
- Critical; the vulnerabilities are already being actively exploited in the wild.
- Action
- Apply the latest security patch from Zimbra immediately.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Zimbra
Get an email when a new Zimbra advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.hkcert.org/security-bulletin/zimbra-multiple-vulnerabilities_20260824
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-73570Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 61% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-73570 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-10631 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-50054 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-50055 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedNCSC-2026-0324 [1.00] [M/H] Vulnerability fixed in Zimbra Collaboration Suitencsc-nl
- unknownexploitedZimbra security advisory (AV26-816) – Update 1cccs
- highexploitedCISA Adds One Known Exploited Vulnerability to Catalogcisa
- criticalexploitedCVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerabilitycisa-kev
- critical[NEW] [high] Synacor Zimbra: Multiple vulnerabilitiescert-bund
- unknownexploitedMultiple vulnerabilities in Synacor Zimbra Collaboration (August 19, 2026)cert-fr-avis
- highCVE-2026-73570: A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when…nvd
More from HKCERT Security Bulletins
- unknownGoogle Chrome Multiple Vulnerabilities2026-08-26
- unknownVeeam Backup & Replication Information Disclosure Vulnerability2026-08-26
- unknownMicrosoft Edge Multiple Vulnerabilities2026-08-24
- unknownGoogle Chrome Multiple Vulnerabilities2026-08-21
- unknownSplunk Products Multiple Vulnerabilities2026-08-20