CVE-2026-73570

Microsoft Tracks Zimbra CVE-2026-73570 Attacks That Steal Mail and Auth Keys Zimbra CVE-2026-73570 command injection attack chain from crafted email to web shells and mailbox theft

Microsoft Tracks Zimbra CVE-2026-73570 Attacks That Steal Mail and Auth Keys

Do Son September 30, 2026

A single crafted email can give attackers a shell on an unpatched Zimbra mail server. Microsoft Threat...

CVE-2026-73570 Exploited in the Wild: Unauthenticated RCE Hits Zimbra Zimbra unauthenticated remote code execution vulnerability CVE-2026-73570 CVSS 8.9 exploited in the wild SNMP advisory

Zimbra unauthenticated remote code execution vulnerability CVE-2026-73570 CVSS 8.9 exploited in the wild SNMP advisory

CVE-2026-73570 Exploited in the Wild: Unauthenticated RCE Hits Zimbra

Do Son August 20, 2026

TL;DR CERT Polska reports active exploitation of a Zimbra unauthenticated remote code execution flaw, tracked as CVE-2026-73570....

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2026-76504CVSS 9.8
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote...
Admin intel📅 Updated: Sep 30, 2026
CVE-2026-86950CVSS 8.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and...
Admin intelCISA KEV📅 Added to KEV: Sep 29, 2026📅 Updated: Sep 29, 2026
CVE-2026-88772
Memory overflow vulnerability leading to remote code execution or denial of service.
Admin intelCISA KEV📅 Added to KEV: Sep 27, 2026📅 Updated: Sep 27, 2026
CVE-2026-88771
Remote code execution due to improper input validation that can allow an unauthenticated attacker to execute arbitrary commands.
Admin intelCISA KEV📅 Added to KEV: Sep 27, 2026📅 Updated: Sep 27, 2026
CVE-2026-65660CVSS 8.8
Improper control of generation of code (\'code injection\') in Microsoft Office SharePoint allows an authorized attacker to execute...
Admin intelCISA KEV📅 Added to KEV: Sep 25, 2026📅 Updated: Sep 25, 2026
CVE-2026-5430CVSS 10.0
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows...
CISA KEV📅 Added to KEV: Sep 24, 2026
CVE-2026-71362CVSS 9.1
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could...
CISA KEV📅 Added to KEV: Sep 24, 2026
CVE-2026-48842CVSS 8.1
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via...
Admin intel📅 Updated: Sep 23, 2026

CVE-2026-100512CVSS 9.8
Contributor PHP Object Injection in Nested Pages
📅 Updated: Sep 30, 2026
CVE-2026-92035CVSS 9.6
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17,...
📅 Updated: Sep 30, 2026
CVE-2026-55107CVSS 10.0
Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby...
📅 Updated: Sep 30, 2026
CVE-2026-55494CVSS 9.8
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows...
📅 Updated: Sep 30, 2026
CVE-2026-100818CVSS 9.6
Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4,...
📅 Updated: Sep 30, 2026
CVE-2026-100819CVSS 9.6
Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR...
📅 Updated: Sep 30, 2026
CVE-2026-100811CVSS 9.6
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox...
📅 Updated: Sep 30, 2026
CVE-2026-100800CVSS 9.6
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR...
📅 Updated: Sep 30, 2026