CISA adds Zimbra flaw to exploited vulnerabilities catalog
CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities Catalog after evidence of active exploitation, and urged organizations to prioritize patching cataloged flaws.
CISA said on Aug. 21 that it added CVE-2026-73570, a Zimbra Collaboration Suite operating-system command injection vulnerability, to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.
The agency said vulnerabilities in the catalog are treated as higher priority for remediation, especially when they can be used against publicly exposed assets and can give an attacker broad control after compromise.
In its alert, CISA said command injection flaws are a frequent attack path for malicious cyber actors and can pose significant risks to the federal enterprise. The agency tied the catalog update to its broader risk-based approach for managing vulnerabilities.
CISA also pointed to Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, which sets vulnerability management requirements for Federal Civilian Executive Branch agencies. According to the alert, the directive requires agencies to move quickly on high-risk vulnerabilities, especially CVEs in the Known Exploited Vulnerabilities Catalog that affect publicly exposed assets and can lead to total control of the system after exploitation.
The notice said the directive also defers action for lower-risk vulnerabilities and sets expectations for when agencies must check whether a system was compromised before patching. CISA said the directive applies only to FCEB agencies, but it encourages all organizations to adopt risk-based vulnerability management and to prioritize remediation of cataloged vulnerabilities.
The alert did not identify additional technical details about the exploitation or say which organizations may have been affected.
CISA said it will continue adding vulnerabilities that meet its criteria and said organizations can submit exploited vulnerabilities not yet listed through its KEV Nomination Form. The agency said submissions must include a CVE ID, evidence of exploitation, and clear mitigation guidance.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()