Column 1
Skip to content

Zimbra 10.1.20 Security Update: Patch New CISA KEV CVE-2026-73570

August 21, 2026

Zimbra Collaboration administrators should treat version 10.1.20 as an urgent update target. CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities Catalog, and Zimbra’s official advisory identifies 10.1.20 as the corrected release. Use the current vendor-supported update path for every affected mail server.

What to do now

  1. Inventory the Zimbra Collaboration version on each server. Record the result in the normal maintenance ticket and identify any instance below 10.1.20.
  2. Plan a controlled mail-service maintenance window. Follow the established approval, recovery, and customer-communication process. Confirm your normal service ownership and escalation contacts before starting.
  3. Apply the current supported Zimbra update. Zimbra identifies 10.1.20 as the security-fix release for this issue. Where a later supported release is available for your deployment, follow the vendor’s current update guidance.
  4. Verify core mail operations after maintenance. Check administrator access, authenticated user access, inbound and outbound mail flow, message queues, scheduled functions, monitoring, and the normal anti-spam and anti-malware services.
  5. Review privileged access and unexpected changes. Remove inactive administrator accounts, confirm individual access for active operators, and use the normal incident process if you find unrecognized server or account activity.

Who is affected

This guide applies to Zimbra Collaboration deployments below 10.1.20. CISA’s KEV Catalog lists the issue as known exploited, while Zimbra’s security advisory maps the correction to 10.1.20. That is enough reason to move the patch ahead of routine mail-server maintenance.

Keep the update controlled

Use the existing recovery, backup, and change-management process for the mail environment. This guide does not create a full-account backup, webroot snapshot, uploads archive, database export, or change to a customer backup schedule. If a server cannot be updated promptly, restrict nonessential management access through the existing approved controls and work with Zimbra support or the hosting provider on a supported remediation plan.

Customer communication and related support

Tell affected users when the maintenance window begins and ends, and provide a known support channel for mail-flow issues after the update. Teams supporting WordPress alongside mail infrastructure can apply the same maintenance, access-review, and verification discipline through Fix I.T. Phill WordPress Support. More server and platform security updates are collected in our security guidance.

Sources