Summary
Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
- Vendor
- Synacor
- Product
- Zimbra Collaboration Suite (ZCS)
- Added to KEV
- Aug 21, 2026
- Remediation due
- Aug 24, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-78
- EPSS
- 76.6% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References