CISA Adds Zimbra Collaboration Suite CVE-2026-73570 to KEV Catalog After Confirmed Exploitation
US authorities have warned organizations about active exploitation of a vulnerability in the collaboration platform Zimbra Collaboration Suite (ZCS). The CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 21, 2026.
The vulnerability, tracked as CVE-2026-73570, is an OS command injection issue located in the SNMP monitoring component. When SNMP notifications are enabled, a specially crafted SMTP request can allow an attacker to execute arbitrary operating system commands without authentication, using the privileges of a Zimbra user.
MITRE assigned the flaw a CVSS v3.1 base score of 8.9, rating it High severity. CISA has directed US federal agencies to implement mitigations by August 24, 2026. All organizations running the affected product should treat the issue as actively exploited and apply available patches or workarounds immediately.
Related articles
IBM Patches 191 Vulnerabilities in AIX and PowerVM VIOS Including Critical Remote Command Execution Flaws
IBM disclosed a large set of security vulnerabilities affecting its UNIX-based AIX operating system and the PowerVM VIOS virtualization component. The company addressed a total of 191 CVEs through multiple updated releases for both products. Thirty-five of the issues received CVSS base scores of 9.0 or higher, with three OS command injection vulnerabilities rated at 9.9 that allow remote attackers to execute commands with low privileges. IBM provided specific Technology Level and Service Pack updates for AIX 7.3 and 7.2 branches along with corresponding fixes for PowerVM VIOS versions 4.1.x. The advisory covers both IBM-developed code and third-party software components integrated into the platforms. All listed CVEs are now resolved in the recommended maintenance levels released on August 15.
Vulnaware Bridges Vulnerability Scanners and ITSM Systems to Improve Critical Flaw Prioritization
A new open-source tool called Vulnaware has been developed to address the persistent gap between vulnerability discovery and remediation in enterprise environments. The project focuses on intelligent prioritization rather than attempting to fix every reported CVE, recognizing that fewer than 10 percent of published vulnerabilities are ever exploited. It integrates outputs from MaxPatrol VM, Nessus Pro, and Greenbone/OpenVAS, then applies scoring based on CISA KEV catalog presence, public exploit availability from Vulncheck feeds, and trend data. Prioritized issues are automatically converted into tickets in Jira Service Management, GLPI, Znuny, and osTicket, while also delivering alerts via Telegram and email. The approach aligns with the updated CISA BOD 26-04 framework that replaced flat 15- and 25-day deadlines with risk-based timelines of 3, 14, or 60 days. By treating vulnerability remediation as a managed change or service request under ITIL4 principles, Vulnaware ensures that critical issues reach the correct engineering teams with proper SLA tracking.
PostgreSQL Releases Security Update Fixing 28 Vulnerabilities and Over 110 Bugs
The PostgreSQL development team issued a major security update on August 13, 2026, addressing 28 vulnerabilities along with more than 110 bugs. While no issues reached a CVSSv3.1 base score of 9.0 or higher, 18 vulnerabilities scored 7.0 or above, with 14 rated at 8.8. Several flaws enable arbitrary code execution, including heap buffer overflows in regular expression processing and the to_char function. Additional fixes cover heap buffer overflows in pg_stat_statements and pg_dump, type confusion issues, and an SQL injection vulnerability. The update resolves specific CVEs such as CVE-2026-14664, CVE-2026-14669, CVE-2026-14670, CVE-2026-16238, CVE-2026-16239, and CVE-2026-15741.
Vulnerability in Docker go-archive Library Allows File Creation and Overwrite Outside Target Directory
A vulnerability has been identified in the go-archive archive processing library used by Docker and related software. The flaw, tracked as CVE-2026-17106, affects the Unpack, UnpackLayer, and Untar functions and permits files to be created or overwritten outside the intended extraction directory. The issue stems from a mismatch between the path string validated by the code and the actual path resolved by the operating system. Docker rated the vulnerability 7.1 under CVSS v4.0 and classified it as High severity. A proof-of-concept exploit has already been published for macOS and Linux. The fix was implemented in go-archive 0.3.0 and shipped in Docker Engine 29.7.0, Docker CLI 29.7.0, and Docker Desktop 4.86.0.