> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 - URL: https://f4n6.co.uk/security-feed/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/ - Published: 2026-09-30T22:09:27.000Z - Updated: 2026-09-30T22:09:27.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-73570 ## 1\. Executive summary CVE-2026-73570 is an unauthenticated OS command injection flaw in the Zimbra Collaboration Suite SNMP notification path, rated CVSS 8.9 HIGH and listed in CISA KEV on 2026-08-21 with a remediation due date of 2026-08-24\. Exploitation requires the optional zimbra-snmp package and SNMP notifications to be enabled, and it delivers command execution as the zimbra service account without credentials or user interaction. Microsoft Threat Intelligence tracked post-exploitation activity that includes JSP web shells, reverse shells, a mailbox-manager/PAM privilege escalation to root, credential harvesting from Zimbra's local configuration and LDAP directory, and mailbox data staged for exfiltration. Shadowserver counted at least 274 compromised internet-facing Zimbra instances by 2026-08-25, and the affected organisations span more than one region and industry. For EMEA financial services clients running internet-facing Zimbra with the SNMP package installed, this is a full mail-platform compromise: session-token signing keys and pre-authentication keys are among the collected material, so mailbox confidentiality cannot be assumed to hold after exploitation. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18 | Exploitation yields Zimbra's zimbraAuthTokenKey and zimbraPreAuthKey, allowing session-token generation and pre-authenticated login URLs for arbitrary accounts. | The compromise is not a single-host availability event. Classification must account for authentication-material loss across the mail platform, which drives the major-incident determination. | | DORA Art. 19 | Confirmed exploitation of an internet-facing mail server with mailbox data archived and transfer attempted. | If classified major, the reporting clock runs from the point of classification, not from discovery of the initial probe. | | NIS2 Art. 23 | Same trigger where the entity is an essential or important entity in scope of NIS2. | Incident notification to the competent authority on the NIS2 timeline, in parallel with any DORA reporting. | DORA Art. 28, 29 and 30 are not engaged by this item on the facts available: the source does not describe a third-party provider failure or a contractual gap. UK NIS 2018 duties apply only where the entity is an OES or RDSP; the source does not identify affected entities by jurisdiction. ## 3\. Technical analysis & attack chain The vulnerability is an OS command injection in Zimbra's SNMP notification path. A crafted SMTP request introduces shell metacharacters into a value that reaches SNMP notification processing. When a service-state change triggers health monitoring, swatchdog incorporates the attacker-controlled value into a snmptrap shell invocation, and the embedded command runs with the privileges of the zimbra service account. Two preconditions must both hold: the optional zimbra-snmp package is installed, and SNMP notifications are enabled. Zimbra 10.1.20, released 2026-07-20, contains the remediation. Public disclosure followed on 2026-08-13. Confirmed steps, in the order Microsoft observed them: 1. Pre-disclosure probing. Between 2026-07-28 and 2026-08-07, two distinct out-of-band scanning tools probed the injection point using the same swatchdog-to-snmptrap path later used in exploitation. Probes went to unique subdomains on oast\[.\]fun, oast\[.\]online, dnslog\[.\]pp\[.\]ua, requestrepo\[.\]com, and infrastructure under bypass\[.\]eu\[.\]org. HTTP requests carried the CVE-specific `ZB73570` User-Agent; DNS and ICMP callbacks used randomised subdomains. Commands used for validation included `curl`, `wget`, `ping`, `nslookup` and `id`. The probes confirmed command execution and external reachability of the server webroot without delivering a payload. 2. Initial access. The crafted SMTP request reaches SNMP notification processing and executes as the zimbra account. 3. Web shell deployment. Attackers changed webroot permissions, reconstructed an encoded and compressed payload from staged fragments, and wrote the decoded payload into publicly accessible application directories. Staging fragments were removed afterwards. Multiple JSP web shells were placed across Jetty and mailboxd application paths, with additional copies on peer mailbox nodes. In some cases write access to a public directory was enabled for the deployment and then restored, so a basic permission check after the fact shows nothing. 4. Alternative execution. The initial command execution was also used to download and run content via `wget` or `curl`, launch background processes, and establish interactive reverse shells. Other chains used cron, systemd, or `memfd_create` for recurring or memory-backed execution. 5. Reconnaissance. The actor mapped the deployment with `zmprov` to identify mailbox and MTA nodes, checked for the Zimbra SSH identity, and sent environment details (including mailbox-server counts) over DNS callbacks. 6. Privilege escalation to root. The actor abused Zimbra's sudo-authorised service helpers and the interaction between `zmmailboxdmgr`, its writable log directory, the sudo PAM configuration, `pam_exec`, and `zmstat-fd`. The sequence: verify the required helpers are exposed and the mailbox manager's log directory is writable; back up `/etc/pam.d/sudo`; replace the legitimate `zmmailboxd.out` log with a symlink to the PAM configuration; invoke the privileged `zmmailboxdmgr` process so the PAM file becomes owned by the zimbra account; add a `pam_exec` session hook invoking a local script; trigger a sudo session through the legitimate `zmstat-fd` helper. The hook ran as root and created a `NOPASSWD: ALL` entry for the zimbra account. The actor then restored the original PAM content and removed staging artefacts while keeping the sudoers entry. Root access was confirmed through subsequent passwordless sudo operations. Fallback paths involving Postfix, a Java agent, `zmstat-fd` and nginx were present in the controller, but the observed child processes show the mailbox-manager/PAM path was the one exercised on this server. 7. Persistence. A systemd service named `zimlog.service` was installed. The name matches a Zimbra logging component, but the payload was placed manually in `/etc/systemd/system/`, outside the Zimbra application directories. The unit file was moved from `/tmp` into the system-wide systemd directory using sudo, assigned to the Zimbra service account, and its timestamps modified to match `rsync.service` and `sshd.service`. It was enabled with `systemctl enable` for execution at boot. 8. Credential and secret collection. The actor ran `zmlocalconfig -s`, which exposed credentials used by LDAP, MySQL, Postfix, Amavis and replication services, then used the recovered credentials for authenticated LDAP queries retrieving `zimbraPreAuthKey`, `zimbraAuthTokenKey` and `zimbraTwoFactorAuthSecret`. The `zmlocalconfig -s` plus authenticated `ldapsearch` sequence was seen across multiple compromised servers. A separate credential-dumping malware family in another environment automated the same collection through a backdoor. 9. Lateral movement. The actor used Zimbra's existing SSH identity at `/opt/zimbra/.ssh/zimbra_identity` to reach trusted cluster nodes, invoking SSH non-interactively with host-key verification disabled. `rsync` moved staged payload fragments, helper scripts and JSP web shells between nodes, with validation of received fragments and removal of source files after transfer. 10. Command and control. HTTP and HTTPS callbacks validated execution, retrieved payloads and returned command output; DNS-label callbacks carried execution confirmation and limited host data. A reverse shell was built from standard Linux utilities: a named pipe at `/tmp/s` connected an interactive `/bin/sh` session to `openssl s_client` holding an encrypted connection to a remote endpoint. 11. Multi-stage payload chain. In one campaign, `agent2.sh`, a lightweight shell downloader, retrieved Stage 1 malware from a dynamic DNS domain and staged it inside Zimbra's log-directory structure. The downloaded `zimdown2` Go binary installed the final `zimclient2` remote-access agent, verifying it by SHA-256, supporting multiple download methods, and reporting installation status over a separate WebSocket channel. It selected writable installation paths and runtime-generated filenames based on the host environment. `zimclient2` provides interactive shell access, bidirectional file operations and SOCKS5 proxying over WebSocket, TLS and raw TCP. 12. Zimbra-specific collection. A Go executable containing the embedded module path `zimbra-exfil/client-dump` was built to run under the Zimbra service account. It reads `/opt/zimbra/conf/localconfig.xml` and extracts `mysql_root_password`, `zimbra_mysql_password`, `ldap_root_password`, `zimbra_ldap_password`, `ldap_postfix_password`, `ldap_amavis_password`, `ldap_nginx_password`, `ldap_replication_password` and `ldap_bes_searcher_password`. It builds MySQL and LDAP connection strings to the local Zimbra MySQL instance over Unix socket and exports full table contents from `mailbox`, `mailbox_metadata`, `mobile_devices` and `out_of_office`, plus all tables under the `zimbra.*` namespace. A `dumpSecrets` function collects SSL certificate and private key files and Postfix LDAP configuration from the filesystem, and queries LDAP for sensitive attributes including `zimbraAuthTokenKey` from `cn=config,cn=zimbra`. Collected files are staged under `/tmp/zimbra_dump_YYYYMMDD_HHMMSS/`, compressed to a ZIP, and prepared for transfer to a remote endpoint supplied as a hex-encoded command-line argument. 13. Exfiltration attempt. On one server the actor archived recent mailbox-backup content to `/opt/zimbra/final.tar.gz`, downloaded AzCopy from hxxps://aka\[.\]ms/downloadazcopy-v10-linux, and invoked it with an operator-supplied Azure Blob SAS URL targeting wsweb03\[.\]blob\[.\]core\[.\]windows\[.\]net/log/windows.log. The available evidence does not confirm the transfer completed. The `zimbraAuthTokenKey` is the key material Zimbra uses to sign user session tokens platform-wide. Possession of it allows session-token generation for arbitrary accounts without account credentials. The pre-authentication key allows construction of pre-authenticated login URLs for any user account. Both were targeted. Confidence caveats. The attack-chain detail above rests on a single vendor report (Microsoft Threat Intelligence, 2026-09-30); the CERT Polska and Shadowserver observations corroborate that exploitation occurred but do not independently confirm the post-exploitation sequence. The 274 compromised instances figure is single-sourced to Shadowserver via Help Net Security and is a point-in-time count, not a current one. Microsoft states the diagram combines behaviours across multiple confirmed compromises and that no single host exhibited every stage; treat the chain as a union of observed behaviours, not a per-host sequence. No actor is named in the source material, and no MITRE ATT&CK group profile is available in the verified reference data, so attribution is unconfirmed. Microsoft's own note that the AzCopy transfer may not have completed means exfiltration success is unproven on that host. ## 4\. Mitigation & containment P1, within 24 hours: - Patch to Zimbra 10.1.20 or later. This is the vendor remediation and the CISA KEV required action; the KEV due date of 2026-08-24 has already passed. - Where patching cannot be completed immediately, disable SNMP notifications and remove the `zimbra-snmp` package. Both preconditions must hold for exploitation, so removing either closes the path. Confirm the package is absent rather than merely stopped. - Assume compromise on any internet-facing Zimbra host that had `zimbra-snmp` installed and SNMP notifications enabled before patching. Patch alone does not evict an established implant. - Rotate every credential exposed by `zmlocalconfig -s`: LDAP, MySQL, Postfix, Amavis and replication service accounts. Rotate `zimbraAuthTokenKey`, `zimbraPreAuthKey` and `zimbraTwoFactorAuthSecret`. Rotating the auth-token key invalidates existing sessions, which is the intended effect. - Remove any `NOPASSWD: ALL` entry for the zimbra account from `/etc/sudoers` and `/etc/sudoers.d/`, and check for a file named `81_metric`. Restore `/etc/pam.d/sudo` from a known-good copy if it was modified. - Disable and remove `zimlog.service`, `chronyd-helper.service` and `syslog_init.service` if present and not part of the approved build. Check `/etc/systemd/system/` for unit files whose timestamps match `rsync.service` or `sshd.service` but whose contents do not. - Revoke and reissue the Zimbra SSH identity at `/opt/zimbra/.ssh/zimbra_identity`, and audit `.ssh/authorized_keys` on every Zimbra node for entries the team did not add. P2, within 72 hours: - Hunt for JSP web shells across `/jetty_base/webapps/`, `/jetty/webapps/`, `/mailboxd/webapps/` and `/work/zimbra/jsp/`, including `_jsp.java` generated sources. Compare against a known-good file inventory rather than relying on directory permissions, which the actor restored after deployment. - Check for cron persistence in `/etc/cron.d/`, user crontabs, `@reboot` entries, and shell startup files (`/etc/profile`, `/etc/bashrc`, `.bash_profile`, `.zprofile`). - Search for memory-backed execution: processes whose path begins `memfd:` or `/proc/self/fd/`, and the campaign process names `.kworker_sys`, `.lpe_core`, `softwaretech`, `ksmd`, `/tmp/init`, `/dev/shm/systemd-resolved`. - Review outbound connections from Zimbra hosts to the C2 indicators in §5, and review DNS logs for callbacks to the interaction services listed in step 1 of the attack chain. - Check for local account creation (`useradd`, `adduser`, password-setting activity) on Zimbra nodes. - Review `/tmp/zimbra_dump_*` directories and `/opt/zimbra/final.tar.gz`; if present, treat mailbox data as exfiltrated. P3, within 7 days: - Review Azure Blob SAS URLs issued to or used from Zimbra hosts, and audit blob storage access logs for the target path in step 13. - Confirm mailbox-level exposure for the window between first suspected exploitation and remediation, and decide on user notification with legal and compliance. - Verify that no Zimbra node retains the pre-patch package state through a snapshot rollback or an unmanaged replica. ## 5\. Indicators of compromise | type | value | confidence | source | | -------- | ----------------------------------------------------------------------------------------------------------- | ---------- | --------- | | ipv4 | 117.107.25\[.\]243:7071 | high | Microsoft | | ipv4 | 192.255.193\[.\]111:9004 | high | Microsoft | | domain | transzimbra\[.\]linkpc\[.\]net | high | Microsoft | | domain | psk1zim\[.\]abrdns\[.\]com | high | Microsoft | | domain | tls\[.\]psk1zim\[.\]abrdns\[.\]com | high | Microsoft | | domain | wslogzimbra\[.\]linkpc\[.\]net | high | Microsoft | | url | hxxps://mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws\[.\]com/pakistan/2026/aliyun\_update.tar.gz | high | Microsoft | | ipv4 | 45.32.30\[.\]235:8081 | high | Microsoft | | ipv4 | 45.32.30\[.\]235:8080 | high | Microsoft | | ipv4 | 193.42.40\[.\]135:443 | high | Microsoft | | ipv4 | 3.209.137\[.\]175:443 | high | Microsoft | | url | hxxps://aka\[.\]ms/downloadazcopy-v10-linux | high | Microsoft | | domain | wsweb03\[.\]blob\[.\]core\[.\]windows\[.\]net | high | Microsoft | | domain | oast\[.\]fun | medium | Microsoft | | domain | oast\[.\]online | medium | Microsoft | | domain | dnslog\[.\]pp\[.\]ua | medium | Microsoft | | domain | requestrepo\[.\]com | medium | Microsoft | | domain | bypass\[.\]eu\[.\]org | medium | Microsoft | | sha256 | dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a | high | Microsoft | | sha256 | aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d | high | Microsoft | | sha256 | 6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244 | high | Microsoft | | sha256 | bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf | high | Microsoft | | sha256 | b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159 | high | Microsoft | | sha256 | 65a7576c389326b6cdf9c993d0be6e5d50fed9655d1cdf2a3a50f2c21c8ec435 | high | Microsoft | | sha256 | 22ef852f6ebc39ee71235b90648b4b200b385c47d25c79545986493f8c70db69 | high | Microsoft | | sha256 | 518fe65dd349180191d9b258ab24876aaed6613cd657d0b626d1fc24e03a22b6 | high | Microsoft | | contract | 0x25bdA7Feb3553995AD68a9A8Ed8c731b73a71586 | medium | Microsoft | The `oast[.]fun`, `oast[.]online`, `dnslog[.]pp[.]ua`, `requestrepo[.]com` and `bypass[.]eu[.]org` entries are public interaction and collaborator services used for probing. They are not attacker-owned infrastructure and will generate false positives if blocked or alerted on without context; treat them as hunt leads, not blocklist entries. The Base contract address is a command channel polled over public JSON-RPC; Microsoft's guidance is to block on JSON-RPC request bodies rather than the public RPC providers. The full IOC set is single-sourced to Microsoft; verify before enforcement. ```iocs ipv4 117.107.25[.]243:7071 ipv4 192.255.193[.]111:9004 domain transzimbra[.]linkpc[.]net domain psk1zim[.]abrdns[.]com domain tls[.]psk1zim[.]abrdns[.]com domain wslogzimbra[.]linkpc[.]net url hxxps://mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws[.]com/pakistan/2026/aliyun_update.tar.gz ipv4 45.32.30[.]235:8081 ipv4 45.32.30[.]235:8080 ipv4 193.42.40[.]135:443 ipv4 3.209.137[.]175:443 url hxxps://aka[.]ms/downloadazcopy-v10-linux domain wsweb03[.]blob[.]core[.]windows[.]net domain oast[.]fun domain oast[.]online domain dnslog[.]pp[.]ua domain requestrepo[.]com domain bypass[.]eu[.]org sha256 dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a sha256 aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d sha256 6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244 sha256 bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf sha256 b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159 sha256 65a7576c389326b6cdf9c993d0be6e5d50fed9655d1cdf2a3a50f2c21c8ec435 sha256 22ef852f6ebc39ee71235b90648b4b200b385c47d25c79545986493f8c70db69 sha256 518fe65dd349180191d9b258ab24876aaed6613cd657d0b626d1fc24e03a22b6 contract 0x25bdA7Feb3553995AD68a9A8Ed8c731b73a71586 ``` Behavioural indicators, for environments where the atomic indicators have rotated: | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------ | ---------- | | Perl process running .swatchdog\_script spawns sh, bash or dash whose command line contains snmptrap, \-c, zmservicename and zmservicestatus | EDR process telemetry | high | | JSP or \_jsp.java file written into Zimbra web application or servlet-work directories by a shell, transfer, decode, Java, jspawnhelper or Perl parent | EDR file telemetry | high | | java or jspawnhelper spawning sh, bash, dash, mkfifo or openssl s\_client | EDR process telemetry | high | | Process executing from memfd:, /proc/self/fd/, or with a path under /dev/shm/ | EDR process telemetry | medium | | zmlocalconfig -s followed by authenticated ldapsearch against cn=config,cn=zimbra | EDR process telemetry, LDAP server logs | high | | SSH invoked non-interactively with host-key verification disabled from a Zimbra host, followed by rsync to a peer node | SSH auth logs, EDR process telemetry | medium | | tar archive written into a public Zimbra web directory under a non-archive extension such as .ico | EDR file telemetry | medium | | azcopy copy invoked with a SAS URL from a Zimbra host | EDR process telemetry, Azure storage access logs | high | | DNS, ICMP or HTTP callbacks from a Zimbra host to randomised subdomains on public interaction services | DNS and proxy logs | medium | ## 6\. Detection The YARA rule below targets the Zimbra-specific collection binary and the multi-stage payload chain. The strings are artefacts of the tooling itself: the embedded module path, the configuration keys the binary extracts, the staging directory pattern, and the campaign process names. The `zimbra-exfil/client-dump` module path is the strongest single indicator. ```yara rule Zimbra_CVE_2026_73570_ExfilTooling { meta: author = "Adverse Trace" date = "2026-09-30" reference = "https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/" description = "Detects Zimbra-specific credential and mailbox collection tooling and the zimdown2/zimclient2 payload chain associated with CVE-2026-73570 exploitation" tlp = "AMBER" strings: $modpath = "zimbra-exfil/client-dump" ascii $cfg1 = "mysql_root_password" ascii $cfg2 = "zimbra_mysql_password" ascii $cfg3 = "ldap_root_password" ascii $cfg4 = "zimbra_ldap_password" ascii $cfg5 = "ldap_postfix_password" ascii $cfg6 = "ldap_amavis_password" ascii $cfg7 = "ldap_nginx_password" ascii $cfg8 = "ldap_replication_password" ascii $cfg9 = "ldap_bes_searcher_password" ascii $dumpfn = "dumpSecrets" ascii $localcfg = "/opt/zimbra/conf/localconfig.xml" ascii $stagedir = "/tmp/zimbra_dump_" ascii $agent = "zimclient2" ascii $installer = "zimdown2" ascii $ws = "/agentws" ascii $wsstat = "/wsstat" ascii condition: uint32(0) == 0x464c457f and ( $modpath or $dumpfn or $localcfg or $stagedir or (3 of ($cfg*)) or ($agent and $ws) or ($installer and $wsstat) ) } ``` The Sigma rule below covers the exploitation boundary and the highest-value post-exploitation behaviours. The swatchdog detection keys on the process lineage Microsoft confirmed: a Perl parent running a generated swatchdog script, spawning a shell whose command line carries the SNMP trap grammar. ```yaml title: Zimbra CVE-2026-73570 SNMP Command Injection and Post-Exploitation id: 8f3c1a72-4d5e-4b91-a6c8-2e7f9b0d1c34 status: experimental description: Detects shell-mediated command execution through Zimbra's swatchdog and snmptrap path, and the JSP web shell, PAM privilege escalation and collection behaviours observed in CVE-2026-73570 exploitation author: Adverse Trace date: 2026/09/30 references: - https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/ tags: - attack.initial_access - attack.t1190 - attack.persistence - attack.t1505.003 - attack.privilege_escalation - attack.t1068 logsource: category: process_creation product: linux detection: selection_injection: ParentImage|endswith: '/perl' ParentCommandLine|contains: '.swatchdog_script' Image|endswith: - '/sh' - '/bash' - '/dash' CommandLine|contains|all: - 'snmptrap' - 'zmservicename' - 'zmservicestatus' selection_webshell: Image|endswith: - '/sh' - '/bash' - '/dash' - '/curl' - '/wget' - '/base64' - '/rsync' CommandLine|contains: - '/jetty_base/webapps/' - '/jetty/webapps/' - '/mailboxd/webapps/' - '/work/zimbra/jsp/' selection_lpe: CommandLine|contains: - 'zmstat-fd' - 'pam_exec' - '/etc/sudoers.d/81_metric' - 'zmmailboxd.out' selection_persistence: CommandLine|contains: - 'zimlog.service' - 'chronyd-helper.service' - 'syslog_init.service' selection_collection: CommandLine|contains: - 'zmlocalconfig -s' - 'zmslapcat' - '/opt/zimbra/final.tar.gz' - 'downloadazcopy-v10-linux' - 'azcopy copy' condition: 1 of selection_* falsepositives: - Approved Zimbra maintenance and administrative activity - Legitimate Zimbra service monitoring that invokes snmptrap without attacker-controlled input level: high ``` Tune both rules against approved Zimbra maintenance windows before enabling in blocking mode. The injection selection will fire on legitimate service-state changes if the environment runs custom SNMP notification scripts; validate the command line contains shell metacharacters before escalating. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-73570](https://nvd.nist.gov/vuln/detail/CVE-2026-73570?ref=f4n6.co.uk) | 8.9 High | ⚠ KEV 2026-08-21 | 12% | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package… | ## 7\. Sources - Microsoft Threat Intelligence, "Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570", https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/, 2026-09-30 - The Hacker News, "Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution", https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html - The Hacker News, "Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets", https://thehackernews.com/2026/09/attackers-exploit-zimbra-flaw-to-deploy.html - CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-73570, via NVD, https://nvd.nist.gov/vuln/detail/CVE-2026-73570 - Help Net Security, "Unpatched Zimbra servers are falling to CVE-2026-73570 attacks", https://www.helpnetsecurity.com/2026/08/25/zimbra-cve-2026-73570-compromised/, 2026-08-25 - SecurityWeek, "Hackers Target Zimbra Servers in Active Exploitation Campaign", https://www.securityweek.com/hackers-target-zimbra-servers-in-active-exploitation-campaign/ - Dark Reading, "Exploited Zimbra Flaw Highlights Shrinking Window to Patch", https://www.darkreading.com/vulnerabilities-threats/zimbra-flaw-exploitation-shrinking-window-patch ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-73570 as CVSS 8.9 HIGH with confirmed exploitation in CISA KEV since 2026-08-21, and the KEV remediation due date of 2026-08-24 has passed. The client impact is severe for any EMEA financial services firm still running internet-facing Zimbra with the SNMP package enabled: the collected material includes the platform-wide session-token signing key and the pre-authentication key, so an attacker who reached this stage can mint sessions for arbitrary accounts, and mailbox confidentiality cannot be assumed to hold. We treat the post-exploitation chain as single-sourced to Microsoft and the 274-instance compromise count as single-sourced to Shadowserver; both are consistent with the CERT Polska and CISA observations but neither is independently corroborated here. No actor is named in the source material and no MITRE ATT&CK group profile is available, so we make no attribution. We will track Zimbra vendor advisories for follow-on fixes, monitor for additional victim counts and any change to the KEV ransomware-use status, and update this advisory if a second independent source confirms the privilege-escalation or exfiltration stages. Clients who cannot confirm their Zimbra patch level and SNMP package state within 24 hours should contact us for triage support. --- [Read the original source →](https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*