> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Microsoft catches hackers exploiting Zimbra bug before disclosure - URL: https://f4n6.co.uk/security-feed/microsoft-catches-hackers-exploiting-zimbra-bug-before-disclosure/ - Published: 2026-10-01T21:06:23.000Z - Updated: 2026-10-01T21:06:23.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-73570 ## 1\. Executive summary Attackers exploited CVE-2026-73570, an unauthenticated OS command injection flaw in Zimbra Collaboration Suite (ZCS), against internet-facing mail servers weeks before the vulnerability was publicly disclosed. Microsoft Threat Intelligence tracked two distinct scanning tools probing the vulnerable injection path between July 28 and August 7, 2026, after Zimbra shipped a fix in version 10.1.20 on July 20 but before public disclosure on August 13\. The flaw carries a CVSS of 8.9 (HIGH), is listed in CISA KEV with an exploitation date of 2026-08-21 and a remediation due date of 2026-08-24, and has an EPSS of 12%. Post-exploitation activity included JSP web shells, reverse shells, privilege escalation to root, persistent remote-access tooling, and mailbox and credential harvesting, with at least one attempted exfiltration of archived mailbox backups to Azure Blob Storage. EMEA financial services firms running Zimbra with the optional SNMP package enabled are exposed to unauthenticated remote code execution from a single crafted email; the KEV due date has already passed, so any unpatched instance is overdue. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | Microsoft observed hands-on-keyboard activity, privilege escalation to root, and mailbox/credential harvesting on compromised Zimbra servers, which are ICT systems supporting email. | Firms must run these through their incident management process, including detection, containment, and root-cause handling, not treat them as a patch-only event. | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | The exploitation path yields command execution as the zimbra service account and access to authentication secrets and mailbox data, which can meet the major-incident threshold. | If a Zimbra instance is confirmed compromised, assess against the major-incident criteria and report to the competent authority within the applicable timeline. | | NIS2 Art. 23: incident reporting obligations | Same confirmed-compromise trigger as above for entities in scope of NIS2. | Where the firm is an in-scope entity, the incident reporting obligation is engaged on the same facts; align the DORA and NIS2 notifications rather than running them separately. | ## 3\. Technical analysis & attack chain CVE-2026-73570 is an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. It is classified CWE-78 (OS Command Injection) in the verified reference data; the source material describes the same flaw as a code injection issue, which is a naming difference for the same mechanism, not a separate vulnerability. CVSS is 8.9 (HIGH). Exploitation requires the optional zimbra-snmp package to be installed and SNMP notifications to be enabled. Where those conditions are met, an attacker can send a specially crafted SMTP request containing shell metacharacters that reaches SNMP notification processing, and embedded shell commands execute with the privileges of the zimbra service account. No authentication and no user interaction are required. Confirmed attack chain, from Microsoft Threat Intelligence: 1. Reconnaissance and probing. Between July 28 and August 7, 2026, two distinct out-of-band scanning tools probed the vulnerable injection point. The activity used the same swatchdog-to-snmptrap execution path later seen in exploitation. 2. Command execution validation. Operators confirmed execution using lightweight out-of-band probes to unique subdomains on public interaction and collaborator services, including oast\[.\]fun, oast\[.\]online, dnslog\[.\]pp\[.\]ua, requestrepo\[.\]com, and campaign-associated infrastructure under bypass\[.\]eu\[.\]org. Probes used curl, wget, ping, nslookup, and id, with HTTP requests carrying the CVE-specific ZB73570 User-Agent and DNS/ICMP requests using randomized callback subdomains. Some probes performed local identity checks or dropped a small system fingerprint script to demonstrate both command execution and external access to the server's webroot. 3. Web shell deployment. Attackers changed webroot permissions, reconstructed an encoded and compressed payload from staged fragments, and wrote the decoded payload to publicly accessible application directories. The staging fragments were then removed, leaving the web shell reachable over HTTP. Microsoft observed JSP web shells. 4. Reverse shells and in-memory execution. Attackers deployed reverse shells and ran malicious code directly in memory, and used the initial command execution to download and execute content via wget or curl and launch background processes. 5. Privilege escalation. On at least one compromised machine, attackers turned the initial foothold into root access, then configured passwordless execution of commands with the highest privileges. 6. Persistence. Attackers installed tools for persistent remote access. 7. Credential and mailbox access. Attackers hunted for Zimbra credentials and authentication secrets usable to access user accounts. One tool Microsoft uncovered was built specifically to extract service account credentials and pull mailbox information from Zimbra's databases. 8. Lateral movement. Attackers explored the wider Zimbra environments, identified other mail servers, and looked for trusted connections between them. In some cases existing SSH relationships between Zimbra systems provided a route to neighboring servers. 9. Exfiltration attempt. In one incident, attackers bundled recent mailbox backups into an archive and attempted to ship it to Azure Blob Storage using Microsoft's AzCopy utility. Microsoft could not confirm from available evidence whether the transfer succeeded. Anti-forensics. Attackers temporarily changed permissions on public directories to plant web shells, then restored the original settings afterward, an apparent attempt to reduce visibility of the modification. Scope and attribution. Microsoft observed affected organizations across multiple regions and industries, with activity ranging from automated exploitation to deliberate hands-on-keyboard operations. Microsoft has not attributed the activity to a particular crew. No MITRE ATT&CK profile for a named actor is present in the verified reference data, so any attribution is unconfirmed and should not be used for decision-making. Shadowserver Foundation reported at least 274 internet-facing Zimbra instances compromised via this flaw; that figure is single-sourced and should be treated as a lower bound rather than a complete count. Confidence caveats. The technical chain above rests primarily on Microsoft Threat Intelligence reporting, with corroboration of the vulnerability's existence and active exploitation from CERT Polska and Shadowserver. The specific tooling, callback infrastructure, and exfiltration attempt are single-sourced to Microsoft; verify before acting on the infrastructure indicators. The AzCopy exfiltration outcome is explicitly unconfirmed by Microsoft. ## 4\. Mitigation & containment P1 (within 24 hours) - Identify every Zimbra Collaboration Suite instance, internal and internet-facing, and determine whether the optional zimbra-snmp package is installed and whether SNMP notifications are enabled. Instances with both conditions are the exposed population. - Patch to Zimbra 10.1.20 or later. This is the vendor fix and the only complete remediation. The CISA KEV remediation due date of 2026-08-24 has passed; treat any unpatched instance as overdue. - Where patching cannot be completed immediately, remove the optional SNMP package or disable SNMP notifications. This removes the exploitation precondition and is the vendor-endorsed interim mitigation. - Hunt for the post-exploitation artefacts: JSP web shells in publicly accessible application directories, unexpected changes to webroot permissions, reverse-shell processes, and background processes spawned by the zimbra service account. - Review Zimbra service account and authentication secrets for signs of access, and rotate credentials and secrets on any instance with confirmed or suspected compromise. P2 (within 72 hours) - Audit SSH trust relationships between Zimbra systems. Existing SSH relationships were used for lateral movement; remove or restrict any that are not operationally required. - Review outbound network activity from Zimbra servers to Azure Blob Storage, and specifically any use of AzCopy, for evidence of the mailbox-backup exfiltration attempt. - Check for passwordless privileged execution configured on Zimbra hosts, which attackers set up after escalating to root. - Review mail server logs for the ZB73570 User-Agent string and for HTTP, DNS, or ICMP callbacks to the interaction and collaborator services listed in §5. P3 (within 7 days) - Confirm that no Zimbra instance remains below 10.1.20, and that SNMP notifications are disabled on any instance where the package cannot be removed. - Review mailbox backup retention and access controls, given that attackers targeted recent mailbox backups for exfiltration. - Where compromise is confirmed, run the incident through the DORA Art. 17 process and assess against the Art. 19 and NIS2 Art. 23 reporting thresholds. ## 5\. Indicators of compromise | type | value | confidence | source | | ---------- | --------------------- | ---------- | ---------------------------------------------- | | user-agent | ZB73570 | medium | Microsoft Threat Intelligence (single-sourced) | | domain | oast\[.\]fun | medium | Microsoft Threat Intelligence (single-sourced) | | domain | oast\[.\]online | medium | Microsoft Threat Intelligence (single-sourced) | | domain | dnslog\[.\]pp\[.\]ua | medium | Microsoft Threat Intelligence (single-sourced) | | domain | requestrepo\[.\]com | medium | Microsoft Threat Intelligence (single-sourced) | | domain | bypass\[.\]eu\[.\]org | medium | Microsoft Threat Intelligence (single-sourced) | | tool | AzCopy | medium | Microsoft Threat Intelligence (single-sourced) | | command | curl | medium | Microsoft Threat Intelligence (single-sourced) | | command | wget | medium | Microsoft Threat Intelligence (single-sourced) | | command | ping | medium | Microsoft Threat Intelligence (single-sourced) | | command | nslookup | medium | Microsoft Threat Intelligence (single-sourced) | | command | id | medium | Microsoft Threat Intelligence (single-sourced) | The domain and user-agent indicators are single-sourced to Microsoft Threat Intelligence. Verify before enforcement; the interaction and collaborator services (oast\[.\]fun, oast\[.\]online, dnslog\[.\]pp\[.\]ua, requestrepo\[.\]com) are legitimate public services that may also appear in benign testing, so treat callbacks to them as suspicious only in context. The commands listed are common network utilities and are not malicious on their own; they are indicators only when observed in the swatchdog-to-snmptrap execution path or spawned by the zimbra service account. ```iocs user-agent ZB73570 domain oast[.]fun domain oast[.]online domain dnslog[.]pp[.]ua domain requestrepo[.]com domain bypass[.]eu[.]org tool AzCopy command curl command wget command ping command nslookup command id ``` Behavioural indicators | behaviour | where to observe | confidence | | --------------------------------------------------------------------------------------------- | ------------------------------------------------- | ---------- | | Crafted SMTP request reaching SNMP notification processing via the swatchdog-to-snmptrap path | Zimbra mail logs, SNMP notification logs | high | | Webroot permissions temporarily changed, then restored | File system audit logs on Zimbra hosts | medium | | JSP web shell written to publicly accessible application directories | Web server access logs, file integrity monitoring | high | | Reverse shell and background processes spawned by the zimbra service account | EDR process telemetry | high | | Passwordless privileged command execution configured after root escalation | sudoers configuration, PAM logs | medium | | SSH connections between Zimbra systems not matching normal administrative patterns | SSH auth logs | medium | | AzCopy execution or outbound transfers to Azure Blob Storage from Zimbra hosts | Process telemetry, network egress logs | medium | ## 6\. Detection ```yara rule Zimbra_CVE_2026_73570_Webshell_Indicators { meta: author = "Adverse Trace" date = "2026-10-01" reference = "https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/" description = "Detects JSP web shell artefacts and callback indicators associated with CVE-2026-73570 exploitation in Zimbra Collaboration Suite" strings: $ua = "ZB73570" ascii wide $cb1 = "oast.fun" ascii wide $cb2 = "oast.online" ascii wide $cb3 = "dnslog.pp.ua" ascii wide $cb4 = "requestrepo.com" ascii wide $cb5 = "bypass.eu.org" ascii wide $cmd1 = "snmptrap" ascii wide $cmd2 = "swatchdog" ascii wide $tool = "AzCopy" ascii wide condition: uint16(0) == 0x4D5A or 3 of them } ``` ```yaml title: Zimbra CVE-2026-73570 Exploitation via SNMP Notification Path id: 8f3a1c72-4b6e-4d21-9a7f-2c5e8d1b0f34 status: experimental description: Detects command execution through the Zimbra swatchdog-to-snmptrap path and associated callback activity consistent with CVE-2026-73570 exploitation author: Adverse Trace date: 2026/10/01 references: - https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/ logsource: category: process_creation product: linux detection: selection_snmptrap: ParentImage|endswith: '/swatchdog' Image|endswith: '/snmptrap' selection_utilities: Image|endswith: - '/curl' - '/wget' - '/ping' - '/nslookup' - '/id' ParentImage|endswith: '/swatchdog' selection_azcopy: Image|endswith: '/azcopy' condition: selection_snmptrap or selection_utilities or selection_azcopy falsepositives: - Legitimate SNMP monitoring and health-check scripts invoking network utilities - Administrative use of AzCopy on mail infrastructure level: high ``` The Sigma rule keys on the swatchdog parent process, which is the distinctive element of this exploitation path. Legitimate SNMP monitoring may invoke the same utilities, so tune against known-good monitoring scripts before enabling in blocking mode. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-73570](https://nvd.nist.gov/vuln/detail/CVE-2026-73570?ref=f4n6.co.uk) | 8.9 High | ⚠ KEV 2026-08-21 | 12% | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package… | ## 7\. Sources - Microsoft Threat Intelligence, "Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570", https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/, 2026-09-30 - The Register, "Microsoft catches hackers exploiting Zimbra bug before disclosure", https://www.theregister.com/security/2026/10/01/microsoft-catches-hackers-exploiting-zimbra-bug-before-disclosure/5300543, 2026-10-01 - The Hacker News, "Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets", https://thehackernews.com/2026/09/attackers-exploit-zimbra-flaw-to-deploy.html - The Hacker News, "Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution", https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html - Help Net Security, "Unpatched Zimbra servers are falling to CVE-2026-73570 attacks", https://www.helpnetsecurity.com/2026/08/25/zimbra-cve-2026-73570-compromised/, 2026-08-25 - SecurityWeek, "Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure", https://www.securityweek.com/zimbra-vulnerability-exploited-in-the-wild-prior-to-public-disclosure/ - CISA Known Exploited Vulnerabilities, CVE-2026-73570, https://nvd.nist.gov/vuln/detail/CVE-2026-73570 ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-73570 as a high-severity, actively exploited vulnerability with a confirmed CISA KEV listing and a remediation due date that has already passed, which places any unpatched, internet-facing Zimbra instance with SNMP notifications enabled in the overdue category. The post-exploitation chain Microsoft documented, from web shell deployment through root escalation and mailbox and credential harvesting, means a confirmed compromise is a data-access incident, not a patching event, and should be run through the DORA Art. 17 process with an Art. 19 and NIS2 Art. 23 reporting assessment. Attribution is unconfirmed: Microsoft has not named a crew, and no MITRE ATT&CK profile for a named actor appears in our reference data, so we do not attribute this activity. The tooling, callback infrastructure, and exfiltration attempt are single-sourced to Microsoft and should be verified before enforcement. We will monitor for further vendor reporting on the exploitation tooling and for any attribution, and will update this advisory if the indicator set is corroborated by a second source. --- [Read the original source →](https://www.theregister.com/security/2026/10/01/microsoft-catches-hackers-exploiting-zimbra-bug-before-disclosure/5300543?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*