CISA Orders Immediate Patch for Actively Exploited Zimbra RCE Vulnerability (CVE‑2026‑73570)
What Happened – The Cybersecurity and Infrastructure Security Agency (CISA) has mandated that all U.S. federal civilian agencies apply the July 20 patch for Zimbra Collaboration Suite (ZCS) version 10.1.20, which fixes CVE‑2026‑73570. The flaw is a command‑injection issue in the SNMP monitoring component that allows unauthenticated remote code execution (RCE) when SNMP notifications are enabled.
Why It Matters for Compliance & Audit Readiness
- The vulnerability directly challenges the Security principle of SOC 2 by exposing systems to unauthenticated code execution, a scenario continuous‑control monitoring is designed to detect and remediate.
- Demonstrating timely patch management and evidence of remediation satisfies the Change Management and Risk Management criteria that auditors scrutinize during SOC 2 assessments.
- Verisq’s Control Mapping capability can automatically map the Zimbra patch to relevant SOC 2 controls, collect evidence of patch deployment, and store it in a Trust Center for audit review.
Who Is Affected – Email and collaboration platform providers, large enterprises, government agencies, and any organization that runs Zimbra servers (hundreds of millions of users worldwide).
Recommended Actions
- Verify Zimbra version and confirm SNMP notifications are disabled or patched to 10.1.20.
- Pull logs from
/opt/zimbra/jetty/webapps/,/opt/zimbra/jetty_base/webapps/, and/tmp/for the past 30 days to hunt for artifacts of CVE‑2026‑73570 exploitation. - Document patch deployment dates and log‑review findings in a centralized compliance repository to satisfy SOC 2 evidence requirements.
Technical Notes – The flaw is a command‑injection (CWE‑78) in the SNMP notification processing path, triggered by specially crafted SMTP requests. Successful exploitation runs arbitrary OS commands as the zimbra user. CVE‑2026‑73570 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Source: BleepingComputer