CISA Adds Actively Exploited Zimbra CVE-2026-73570 to KEV Catalog with Immediate Patching Deadline
CISA has added the vulnerability CVE-2026-73570 in Zimbra Collaboration Suite to its Known Exploited Vulnerabilities catalog and mandated immediate mitigation. The defect permits remote command execution without authentication on servers running the optional zimbra-snmp package with SNMP notifications enabled.
The Agency for Cybersecurity and Infrastructure Security of the United States has directed federal civilian agencies to apply the fix urgently. Although the directive targets U.S. federal entities, it effectively places maximum priority on any organization operating Zimbra servers exposed to the internet and processing inbound mail from untrusted networks.
The issue enables unauthenticated remote command execution. Exploitation requires the administrator to have installed the optional zimbra-snmp package and enabled SNMP notifications. In this configuration, an attacker can send manipulated SMTP requests that trigger operating-system-level command injection, executing arbitrary commands with the privileges of the zimbra user.
Zimbra corrected the flaw in Zimbra Collaboration Suite 10.1.20, released on July 20, 2026. CISA added the vulnerability to the KEV catalog on August 21, 2026, a step typically reserved for actively exploited issues. The agency set an August 24, 2026 mitigation deadline for the FCEB environment, underscoring the operational risk.
After patching, administrators should verify the version change, perform a controlled service restart, and confirm stability. If intrusion is suspected, further response includes searching for persistence mechanisms, reviewing authentication anomalies, analyzing unusual outbound connections, and rotating associated credentials.
Related articles
CISA Adds Zimbra Collaboration Suite CVE-2026-73570 to KEV Catalog After Confirmed Exploitation
US authorities have issued a warning about active exploitation of a vulnerability in the Zimbra Collaboration Suite. CISA added the OS command injection flaw CVE-2026-73570 to its Known Exploited Vulnerabilities catalog on August 21, 2026, marking the fifth such entry for the year. The issue resides in the SNMP monitoring component and allows unauthenticated attackers to execute arbitrary operating system commands with Zimbra user privileges when SNMP notifications are enabled. MITRE rated the vulnerability 8.9 on CVSS v3.1, classifying it as High severity. Federal agencies must apply mitigations by August 24, while all organizations using the product are urged to prioritize patching to prevent further abuse.
IBM Patches 191 Vulnerabilities in AIX and PowerVM VIOS Including Critical Remote Command Execution Flaws
IBM disclosed a large set of security vulnerabilities affecting its UNIX-based AIX operating system and the PowerVM VIOS virtualization component. The company addressed a total of 191 CVEs through multiple updated releases for both products. Thirty-five of the issues received CVSS base scores of 9.0 or higher, with three OS command injection vulnerabilities rated at 9.9 that allow remote attackers to execute commands with low privileges. IBM provided specific Technology Level and Service Pack updates for AIX 7.3 and 7.2 branches along with corresponding fixes for PowerVM VIOS versions 4.1.x. The advisory covers both IBM-developed code and third-party software components integrated into the platforms. All listed CVEs are now resolved in the recommended maintenance levels released on August 15.
Vulnaware Bridges Vulnerability Scanners and ITSM Systems to Improve Critical Flaw Prioritization
A new open-source tool called Vulnaware has been developed to address the persistent gap between vulnerability discovery and remediation in enterprise environments. The project focuses on intelligent prioritization rather than attempting to fix every reported CVE, recognizing that fewer than 10 percent of published vulnerabilities are ever exploited. It integrates outputs from MaxPatrol VM, Nessus Pro, and Greenbone/OpenVAS, then applies scoring based on CISA KEV catalog presence, public exploit availability from Vulncheck feeds, and trend data. Prioritized issues are automatically converted into tickets in Jira Service Management, GLPI, Znuny, and osTicket, while also delivering alerts via Telegram and email. The approach aligns with the updated CISA BOD 26-04 framework that replaced flat 15- and 25-day deadlines with risk-based timelines of 3, 14, or 60 days. By treating vulnerability remediation as a managed change or service request under ITIL4 principles, Vulnaware ensures that critical issues reach the correct engineering teams with proper SLA tracking.
PostgreSQL Releases Security Update Fixing 28 Vulnerabilities and Over 110 Bugs
The PostgreSQL development team issued a major security update on August 13, 2026, addressing 28 vulnerabilities along with more than 110 bugs. While no issues reached a CVSSv3.1 base score of 9.0 or higher, 18 vulnerabilities scored 7.0 or above, with 14 rated at 8.8. Several flaws enable arbitrary code execution, including heap buffer overflows in regular expression processing and the to_char function. Additional fixes cover heap buffer overflows in pg_stat_statements and pg_dump, type confusion issues, and an SQL injection vulnerability. The update resolves specific CVEs such as CVE-2026-14664, CVE-2026-14669, CVE-2026-14670, CVE-2026-16238, CVE-2026-16239, and CVE-2026-15741.