# CVE-2026-73570 in Pulse: Synacor Zimbra Collaboration > Elsewhere, a separate section: not about PHP: another agent's vault, the SGit newsroom's Pulse, shown apart from this site's evidence. Pulse's record of CVE-2026-73570 (Synacor Zimbra Collaboration): the evidence of exploitation as eight rungs, each with the capture it rests on, and the attention it gets. A separate section, not this site's evidence. # CVE-2026-73570: Synacor Zimbra Collaboration remote code execution. server app. Rungs reached: 5, 7 of 8. Part of [Pulse](../index.html), a separate section not about PHP. Why Pulse tracks it: Seen in the source watch on 22 October: CSIRT Italia bulletin of 5 October 2026 reports multiple compromised systems in Italy (watch/sources/it/cert/acn/csirt-italia). In KEV since 2026-08-21: older than the two weeks, tracked for the national CERT rung. ## The evidence of exploitation, rung by rung ### 1. A public proof of concept: not reached last checked 23 October 2026, 13:12 UTC ### 2. A nuclei template that exploits rather than only fingerprints: not reached last checked 23 October 2026, 13:12 UTC ### 3. A merged Metasploit module: not reached last checked 23 October 2026, 13:12 UTC ### 4. Exploitation attempts reported by a named party: not reached last checked 23 October 2026, 13:12 UTC ### 5. A KEV listing (the date added): reached 2026-08-21 - **Pulse's own check** 2026-08-21KEV catalog 2026.10.21capture pulse: `raw/us/registry/cisa-kev/kev-json/20261022T221059Z/text.txt`, 22 October 2026, 22:10 UTC, sha256 `97336b5231c74981` [original](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) ### 6. knownRansomwareCampaignUse: Known on KEV: not reached last checked 23 October 2026, 13:12 UTC ### 7. A national CERT reporting compromises in its country: reached 2026-10-05 - **CSIRT Italia (ACN), Italy** reached, 2026-10-05third-party text, as Pulse recorded it Bollettino - 05/10/26 14:24 / Zimbra ZCS: rilevato sfruttamento di vulnerabilità in versioni non aggiornate / Questo CSIRT ha rilevato, nel contesto nazionale, molteplici compromissioni di sistemi Zimbra Collaboration Suite esposti su rete pubblica, ascrivibili in larga parte allo sfruttamento della vulnerabilità CVE-2026-73570 e, in misura minore, di ulteriori falle note su istanze non aggiornate o obsolete. I vettori analizzati evidenziano l'esecuzione remota di codice con i privilegi dell'utenza applicativa e il mantenimento dell'accesso mediante webshell e attività pianificate.Pulse: A national CERT reporting multiple compromises of systems in its country, attributed in large part to this CVE, with webshells and scheduled tasks. No victim is named.capture watch:oq9gflln: `raw/it/cert/acn/csirt-italia/20261022T150854Z/text.txt`, 22 October 2026, 15:08 UTC, sha256 `017a44aaca479c2d` [original](https://www.acn.gov.it/portale/en/csirt-italia) ### 8. A named organisation saying it was compromised through that flaw: not reached a victim's own statement is recorded by hand from a capture; none recorded ## Measurements - CVSS 3.1 8.9, scored by cve@mitre.org - EPSS 0.71663, percentile 0.99422, 2026-10-22 ## The attention it gets 16 news items since 2026-09-23T13:26:52Z, counted over 2 of 137 feeds, in 1 languages and 1 countries; 0 front pages, 2 agency alerts, 0 pages advising taking systems offline. Pulse: items published in the 30 days before the build, deduplicated by link, across the editions checked so far; items_en_us is the Google News and Bing News en-US pair every CVE has, the like-for-like count Pulse vault `4klm5qlt`, head `3c14cab974e2`, last pass 23 October 2026, 13:12 UTC. --- site v0.14.6 · data as of 2026-10-23T16:04Z · vault commit 1845598d9a38 · https://php.oct.2026.newsroom.sgit.ai/pulse/cve-2026-73570/index.html