CVE-2026-73570

APPLIANCE FINGERPRINT

NewScan fingerprints the Zimbra Collaboration appliance and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-22 from CISA KEV, the only KEV entry in the day's window. Recorded `critical` rather than NVD's 8.9 under docs/severity-standard.md: it is remote code execution on a mail server, and the two Zimbra rows above it are the same class and are what mass-exploitation campaigns have historically chained. PRECONDITION, and it is a real one: the optional `zimbra-snmp` package must be installed AND SNMP notifications enabled, so this row is a `patch and check your SNMP config` advisory on a confirmed Zimbra rather than a claim the instance is exploitable - the appliance engine cannot see whether an optional package is present. NO `lt` even though the advisory names one (`before 10.1.20`), for the reason the whole appliance_cves pack works this way: the Zimbra appliances.json row fingerprints on /zimbra/, /public/login.jsp, the ZM_TEST cookie and a body marker, and none of those publish a build to an anonymous caller, so there is no number to compare. `fixed_in` is carried anyway because it is what the operator needs to read, and the day a version source for Zimbra is found this row gains its gate without being rewritten.