CISA adds Zimbra flaw to exploited vulnerabilities catalog

By Atlas Watchline Staff · Regulatory · August 21, 2026

CISA said it added CVE-2026-73570, a Zimbra Collaboration Suite command injection flaw, to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.

CISA said on Aug. 21 that it added CVE-2026-73570, a Zimbra Collaboration Suite operating-system command injection vulnerability, to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.

The agency said vulnerabilities in the catalog are treated as higher priority for remediation, especially when they can be used against publicly exposed assets and can give an attacker broad control after compromise.

In its alert, CISA said command injection flaws are a frequent attack path for malicious cyber actors and can pose significant risks to the federal enterprise. The agency tied the catalog update to its broader risk-based approach for managing vulnerabilities.

CISA also pointed to Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, which sets vulnerability management requirements for Federal Civilian Executive Branch agencies. According to the alert, the directive requires agencies to move quickly on high-risk vulnerabilities, especially CVEs in the Known Exploited Vulnerabilities Catalog that affect publicly exposed assets and can lead to total control of the system after exploitation.

The notice said the directive also defers action for lower-risk vulnerabilities and sets expectations for when agencies must check whether a system was compromised before patching. CISA said the directive applies only to FCEB agencies, but it encourages all organizations to adopt risk-based vulnerability management and to prioritize remediation of cataloged vulnerabilities.

The alert did not identify additional technical details about the exploitation or say which organizations may have been affected.

CISA said it will continue adding vulnerabilities that meet its criteria and said organizations can submit exploited vulnerabilities not yet listed through its KEV Nomination Form. The agency said submissions must include a CVE ID, evidence of exploitation, and clear mitigation guidance.

Sources

• CISA alert page

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.