Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

1. Executive summary

CVE-2026-73570 is an unauthenticated OS command injection flaw in the Zimbra Collaboration Suite SNMP notification path, rated CVSS 8.9 HIGH and listed in CISA KEV on 2026-08-21 with a remediation due date of 2026-08-24. Exploitation requires the optional zimbra-snmp package and SNMP notifications to be enabled, and it delivers command execution as the zimbra service account without credentials or user interaction. Microsoft Threat Intelligence tracked post-exploitation activity that includes JSP web shells, reverse shells, a mailbox-manager/PAM privilege escalation to root, credential harvesting from Zimbra's local configuration and LDAP directory, and mailbox data staged for exfiltration. Shadowserver counted at least 274 compromised internet-facing Zimbra instances by 2026-08-25, and the affected organisations span more than one region and industry. For EMEA financial services clients running internet-facing Zimbra with the SNMP package installed, this is a full mail-platform compromise: session-token signing keys and pre-authentication keys are among the collected material, so mailbox confidentiality cannot be assumed to hold after exploitation.

2. Regulatory framing

DORA Art. 28, 29 and 30 are not engaged by this item on the facts available: the source does not describe a third-party provider failure or a contractual gap. UK NIS 2018 duties apply only where the entity is an OES or RDSP; the source does not identify affected entities by jurisdiction.

3. Technical analysis & attack chain

The vulnerability is an OS command injection in Zimbra's SNMP notification path. A crafted SMTP request introduces shell metacharacters into a value that reaches SNMP notification processing. When a service-state change triggers health monitoring, swatchdog incorporates the attacker-controlled value into a snmptrap shell invocation, and the embedded command runs with the privileges of the zimbra service account. Two preconditions must both hold: the optional zimbra-snmp package is installed, and SNMP notifications are enabled. Zimbra 10.1.20, released 2026-07-20, contains the remediation. Public disclosure followed on 2026-08-13.

Confirmed steps, in the order Microsoft observed them:

1. Pre-disclosure probing. Between 2026-07-28 and 2026-08-07, two distinct out-of-band scanning tools probed the injection point using the same swatchdog-to-snmptrap path later used in exploitation. Probes went to unique subdomains on oast[.]fun, oast[.]online, dnslog[.]pp[.]ua, requestrepo[.]com, and infrastructure under bypass[.]eu[.]org. HTTP requests carried the CVE-specific ZB73570 User-Agent; DNS and ICMP callbacks used randomised subdomains. Commands used for validation included curl, wget, ping, nslookup and id. The probes confirmed command execution and external reachability of the server webroot without delivering a payload.
2. Initial access. The crafted SMTP request reaches SNMP notification processing and executes as the zimbra account.
3. Web shell deployment. Attackers changed webroot permissions, reconstructed an encoded and compressed payload from staged fragments, and wrote the decoded payload into publicly accessible application directories. Staging fragments were removed afterwards. Multiple JSP web shells were placed across Jetty and mailboxd application paths, with additional copies on peer mailbox nodes. In some cases write access to a public directory was enabled for the deployment and then restored, so a basic permission check after the fact shows nothing.
4. Alternative execution. The initial command execution was also used to download and run content via wget or curl, launch background processes, and establish interactive reverse shells. Other chains used cron, systemd, or memfd_create for recurring or memory-backed execution.
5. Reconnaissance. The actor mapped the deployment with zmprov to identify mailbox and MTA nodes, checked for the Zimbra SSH identity, and sent environment details (including mailbox-server counts) over DNS callbacks.
6. Privilege escalation to root. The actor abused Zimbra's sudo-authorised service helpers and the interaction between zmmailboxdmgr, its writable log directory, the sudo PAM configuration, pam_exec, and zmstat-fd. The sequence: verify the required helpers are exposed and the mailbox manager's log directory is writable; back up /etc/pam.d/sudo; replace the legitimate zmmailboxd.out log with a symlink to the PAM configuration; invoke the privileged zmmailboxdmgr process so the PAM file becomes owned by the zimbra account; add a pam_exec session hook invoking a local script; trigger a sudo session through the legitimate zmstat-fd helper. The hook ran as root and created a NOPASSWD: ALL entry for the zimbra account. The actor then restored the original PAM content and removed staging artefacts while keeping the sudoers entry. Root access was confirmed through subsequent passwordless sudo operations. Fallback paths involving Postfix, a Java agent, zmstat-fd and nginx were present in the controller, but the observed child processes show the mailbox-manager/PAM path was the one exercised on this server.
7. Persistence. A systemd service named zimlog.service was installed. The name matches a Zimbra logging component, but the payload was placed manually in /etc/systemd/system/, outside the Zimbra application directories. The unit file was moved from /tmp into the system-wide systemd directory using sudo, assigned to the Zimbra service account, and its timestamps modified to match rsync.service and sshd.service. It was enabled with systemctl enable for execution at boot.
8. Credential and secret collection. The actor ran zmlocalconfig -s, which exposed credentials used by LDAP, MySQL, Postfix, Amavis and replication services, then used the recovered credentials for authenticated LDAP queries retrieving zimbraPreAuthKey, zimbraAuthTokenKey and zimbraTwoFactorAuthSecret. The zmlocalconfig -s plus authenticated ldapsearch sequence was seen across multiple compromised servers. A separate credential-dumping malware family in another environment automated the same collection through a backdoor.
9. Lateral movement. The actor used Zimbra's existing SSH identity at /opt/zimbra/.ssh/zimbra_identity to reach trusted cluster nodes, invoking SSH non-interactively with host-key verification disabled. rsync moved staged payload fragments, helper scripts and JSP web shells between nodes, with validation of received fragments and removal of source files after transfer.
10. Command and control. HTTP and HTTPS callbacks validated execution, retrieved payloads and returned command output; DNS-label callbacks carried execution confirmation and limited host data. A reverse shell was built from standard Linux utilities: a named pipe at /tmp/s connected an interactive /bin/sh session to openssl s_client holding an encrypted connection to a remote endpoint.
11. Multi-stage payload chain. In one campaign, agent2.sh, a lightweight shell downloader, retrieved Stage 1 malware from a dynamic DNS domain and staged it inside Zimbra's log-directory structure. The downloaded zimdown2 Go binary installed the final zimclient2 remote-access agent, verifying it by SHA-256, supporting multiple download methods, and reporting installation status over a separate WebSocket channel. It selected writable installation paths and runtime-generated filenames based on the host environment. zimclient2 provides interactive shell access, bidirectional file operations and SOCKS5 proxying over WebSocket, TLS and raw TCP.
12. Zimbra-specific collection. A Go executable containing the embedded module path zimbra-exfil/client-dump was built to run under the Zimbra service account. It reads /opt/zimbra/conf/localconfig.xml and extracts mysql_root_password, zimbra_mysql_password, ldap_root_password, zimbra_ldap_password, ldap_postfix_password, ldap_amavis_password, ldap_nginx_password, ldap_replication_password and ldap_bes_searcher_password. It builds MySQL and LDAP connection strings to the local Zimbra MySQL instance over Unix socket and exports full table contents from mailbox, mailbox_metadata, mobile_devices and out_of_office, plus all tables under the zimbra.* namespace. A dumpSecrets function collects SSL certificate and private key files and Postfix LDAP configuration from the filesystem, and queries LDAP for sensitive attributes including zimbraAuthTokenKey from cn=config,cn=zimbra. Collected files are staged under /tmp/zimbra_dump_YYYYMMDD_HHMMSS/, compressed to a ZIP, and prepared for transfer to a remote endpoint supplied as a hex-encoded command-line argument.
13. Exfiltration attempt. On one server the actor archived recent mailbox-backup content to /opt/zimbra/final.tar.gz, downloaded AzCopy from hxxps://aka[.]ms/downloadazcopy-v10-linux, and invoked it with an operator-supplied Azure Blob SAS URL targeting wsweb03[.]blob[.]core[.]windows[.]net/log/windows.log. The available evidence does not confirm the transfer completed.

The zimbraAuthTokenKey is the key material Zimbra uses to sign user session tokens platform-wide. Possession of it allows session-token generation for arbitrary accounts without account credentials. The pre-authentication key allows construction of pre-authenticated login URLs for any user account. Both were targeted.

Confidence caveats. The attack-chain detail above rests on a single vendor report (Microsoft Threat Intelligence, 2026-09-30); the CERT Polska and Shadowserver observations corroborate that exploitation occurred but do not independently confirm the post-exploitation sequence. The 274 compromised instances figure is single-sourced to Shadowserver via Help Net Security and is a point-in-time count, not a current one. Microsoft states the diagram combines behaviours across multiple confirmed compromises and that no single host exhibited every stage; treat the chain as a union of observed behaviours, not a per-host sequence. No actor is named in the source material, and no MITRE ATT&CK group profile is available in the verified reference data, so attribution is unconfirmed. Microsoft's own note that the AzCopy transfer may not have completed means exfiltration success is unproven on that host.

4. Mitigation & containment

P1, within 24 hours:

• Patch to Zimbra 10.1.20 or later. This is the vendor remediation and the CISA KEV required action; the KEV due date of 2026-08-24 has already passed.
• Where patching cannot be completed immediately, disable SNMP notifications and remove the zimbra-snmp package. Both preconditions must hold for exploitation, so removing either closes the path. Confirm the package is absent rather than merely stopped.
• Assume compromise on any internet-facing Zimbra host that had zimbra-snmp installed and SNMP notifications enabled before patching. Patch alone does not evict an established implant.
• Rotate every credential exposed by zmlocalconfig -s: LDAP, MySQL, Postfix, Amavis and replication service accounts. Rotate zimbraAuthTokenKey, zimbraPreAuthKey and zimbraTwoFactorAuthSecret. Rotating the auth-token key invalidates existing sessions, which is the intended effect.
• Remove any NOPASSWD: ALL entry for the zimbra account from /etc/sudoers and /etc/sudoers.d/, and check for a file named 81_metric. Restore /etc/pam.d/sudo from a known-good copy if it was modified.
• Disable and remove zimlog.service, chronyd-helper.service and syslog_init.service if present and not part of the approved build. Check /etc/systemd/system/ for unit files whose timestamps match rsync.service or sshd.service but whose contents do not.
• Revoke and reissue the Zimbra SSH identity at /opt/zimbra/.ssh/zimbra_identity, and audit .ssh/authorized_keys on every Zimbra node for entries the team did not add.

P2, within 72 hours:

• Hunt for JSP web shells across /jetty_base/webapps/, /jetty/webapps/, /mailboxd/webapps/ and /work/zimbra/jsp/, including _jsp.java generated sources. Compare against a known-good file inventory rather than relying on directory permissions, which the actor restored after deployment.
• Check for cron persistence in /etc/cron.d/, user crontabs, @reboot entries, and shell startup files (/etc/profile, /etc/bashrc, .bash_profile, .zprofile).
• Search for memory-backed execution: processes whose path begins memfd: or /proc/self/fd/, and the campaign process names .kworker_sys, .lpe_core, softwaretech, ksmd, /tmp/init, /dev/shm/systemd-resolved.
• Review outbound connections from Zimbra hosts to the C2 indicators in §5, and review DNS logs for callbacks to the interaction services listed in step 1 of the attack chain.
• Check for local account creation (useradd, adduser, password-setting activity) on Zimbra nodes.
• Review /tmp/zimbra_dump_* directories and /opt/zimbra/final.tar.gz; if present, treat mailbox data as exfiltrated.

P3, within 7 days:

• Review Azure Blob SAS URLs issued to or used from Zimbra hosts, and audit blob storage access logs for the target path in step 13.
• Confirm mailbox-level exposure for the window between first suspected exploitation and remediation, and decide on user notification with legal and compliance.
• Verify that no Zimbra node retains the pre-patch package state through a snapshot rollback or an unmanaged replica.

5. Indicators of compromise

The oast[.]fun, oast[.]online, dnslog[.]pp[.]ua, requestrepo[.]com and bypass[.]eu[.]org entries are public interaction and collaborator services used for probing. They are not attacker-owned infrastructure and will generate false positives if blocked or alerted on without context; treat them as hunt leads, not blocklist entries. The Base contract address is a command channel polled over public JSON-RPC; Microsoft's guidance is to block on JSON-RPC request bodies rather than the public RPC providers. The full IOC set is single-sourced to Microsoft; verify before enforcement.

ipv4  117.107.25[.]243:7071
ipv4  192.255.193[.]111:9004
domain  transzimbra[.]linkpc[.]net
domain  psk1zim[.]abrdns[.]com
domain  tls[.]psk1zim[.]abrdns[.]com
domain  wslogzimbra[.]linkpc[.]net
url  hxxps://mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws[.]com/pakistan/2026/aliyun_update.tar.gz
ipv4  45.32.30[.]235:8081
ipv4  45.32.30[.]235:8080
ipv4  193.42.40[.]135:443
ipv4  3.209.137[.]175:443
url  hxxps://aka[.]ms/downloadazcopy-v10-linux
domain  wsweb03[.]blob[.]core[.]windows[.]net
domain  oast[.]fun
domain  oast[.]online
domain  dnslog[.]pp[.]ua
domain  requestrepo[.]com
domain  bypass[.]eu[.]org
sha256  dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a
sha256  aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d
sha256  6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244
sha256  bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf
sha256  b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159
sha256  65a7576c389326b6cdf9c993d0be6e5d50fed9655d1cdf2a3a50f2c21c8ec435
sha256  22ef852f6ebc39ee71235b90648b4b200b385c47d25c79545986493f8c70db69
sha256  518fe65dd349180191d9b258ab24876aaed6613cd657d0b626d1fc24e03a22b6
contract  0x25bdA7Feb3553995AD68a9A8Ed8c731b73a71586

Behavioural indicators, for environments where the atomic indicators have rotated:

6. Detection

The YARA rule below targets the Zimbra-specific collection binary and the multi-stage payload chain. The strings are artefacts of the tooling itself: the embedded module path, the configuration keys the binary extracts, the staging directory pattern, and the campaign process names. The zimbra-exfil/client-dump module path is the strongest single indicator.

rule Zimbra_CVE_2026_73570_ExfilTooling
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-30"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/"
        description = "Detects Zimbra-specific credential and mailbox collection tooling and the zimdown2/zimclient2 payload chain associated with CVE-2026-73570 exploitation"
        tlp = "AMBER"

    strings:
        $modpath = "zimbra-exfil/client-dump" ascii
        $cfg1 = "mysql_root_password" ascii
        $cfg2 = "zimbra_mysql_password" ascii
        $cfg3 = "ldap_root_password" ascii
        $cfg4 = "zimbra_ldap_password" ascii
        $cfg5 = "ldap_postfix_password" ascii
        $cfg6 = "ldap_amavis_password" ascii
        $cfg7 = "ldap_nginx_password" ascii
        $cfg8 = "ldap_replication_password" ascii
        $cfg9 = "ldap_bes_searcher_password" ascii
        $dumpfn = "dumpSecrets" ascii
        $localcfg = "/opt/zimbra/conf/localconfig.xml" ascii
        $stagedir = "/tmp/zimbra_dump_" ascii
        $agent = "zimclient2" ascii
        $installer = "zimdown2" ascii
        $ws = "/agentws" ascii
        $wsstat = "/wsstat" ascii

    condition:
        uint32(0) == 0x464c457f and
        (
            $modpath or
            $dumpfn or
            $localcfg or
            $stagedir or
            (3 of ($cfg*)) or
            ($agent and $ws) or
            ($installer and $wsstat)
        )
}

The Sigma rule below covers the exploitation boundary and the highest-value post-exploitation behaviours. The swatchdog detection keys on the process lineage Microsoft confirmed: a Perl parent running a generated swatchdog script, spawning a shell whose command line carries the SNMP trap grammar.

title: Zimbra CVE-2026-73570 SNMP Command Injection and Post-Exploitation
id: 8f3c1a72-4d5e-4b91-a6c8-2e7f9b0d1c34
status: experimental
description: Detects shell-mediated command execution through Zimbra's swatchdog and snmptrap path, and the JSP web shell, PAM privilege escalation and collection behaviours observed in CVE-2026-73570 exploitation
author: Adverse Trace
date: 2026/09/30
references:

    - https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/
tags:

    - attack.initial_access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - attack.privilege_escalation
    - attack.t1068
logsource:
    category: process_creation
    product: linux
detection:
    selection_injection:
        ParentImage|endswith: '/perl'
        ParentCommandLine|contains: '.swatchdog_script'
        Image|endswith:

            - '/sh'
            - '/bash'
            - '/dash'
        CommandLine|contains|all:

            - 'snmptrap'
            - 'zmservicename'
            - 'zmservicestatus'
    selection_webshell:
        Image|endswith:

            - '/sh'
            - '/bash'
            - '/dash'
            - '/curl'
            - '/wget'
            - '/base64'
            - '/rsync'
        CommandLine|contains:

            - '/jetty_base/webapps/'
            - '/jetty/webapps/'
            - '/mailboxd/webapps/'
            - '/work/zimbra/jsp/'
    selection_lpe:
        CommandLine|contains:

            - 'zmstat-fd'
            - 'pam_exec'
            - '/etc/sudoers.d/81_metric'
            - 'zmmailboxd.out'
    selection_persistence:
        CommandLine|contains:

            - 'zimlog.service'
            - 'chronyd-helper.service'
            - 'syslog_init.service'
    selection_collection:
        CommandLine|contains:

            - 'zmlocalconfig -s'
            - 'zmslapcat'
            - '/opt/zimbra/final.tar.gz'
            - 'downloadazcopy-v10-linux'
            - 'azcopy copy'
    condition: 1 of selection_*
falsepositives:

    - Approved Zimbra maintenance and administrative activity
    - Legitimate Zimbra service monitoring that invokes snmptrap without attacker-controlled input
level: high

Tune both rules against approved Zimbra maintenance windows before enabling in blocking mode. The injection selection will fire on legitimate service-state changes if the environment runs custom SNMP notification scripts; validate the command line contains shell metacharacters before escalating.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• Microsoft Threat Intelligence, "Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570", https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/, 2026-09-30
• The Hacker News, "Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution", https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html
• The Hacker News, "Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets", https://thehackernews.com/2026/09/attackers-exploit-zimbra-flaw-to-deploy.html
• CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-73570, via NVD, https://nvd.nist.gov/vuln/detail/CVE-2026-73570
• Help Net Security, "Unpatched Zimbra servers are falling to CVE-2026-73570 attacks", https://www.helpnetsecurity.com/2026/08/25/zimbra-cve-2026-73570-compromised/, 2026-08-25
• SecurityWeek, "Hackers Target Zimbra Servers in Active Exploitation Campaign", https://www.securityweek.com/hackers-target-zimbra-servers-in-active-exploitation-campaign/
• Dark Reading, "Exploited Zimbra Flaw Highlights Shrinking Window to Patch", https://www.darkreading.com/vulnerabilities-threats/zimbra-flaw-exploitation-shrinking-window-patch

8. Adverse Trace position

Adverse Trace assesses CVE-2026-73570 as CVSS 8.9 HIGH with confirmed exploitation in CISA KEV since 2026-08-21, and the KEV remediation due date of 2026-08-24 has passed. The client impact is severe for any EMEA financial services firm still running internet-facing Zimbra with the SNMP package enabled: the collected material includes the platform-wide session-token signing key and the pre-authentication key, so an attacker who reached this stage can mint sessions for arbitrary accounts, and mailbox confidentiality cannot be assumed to hold. We treat the post-exploitation chain as single-sourced to Microsoft and the 274-instance compromise count as single-sourced to Shadowserver; both are consistent with the CERT Polska and CISA observations but neither is independently corroborated here. No actor is named in the source material and no MITRE ATT&CK group profile is available, so we make no attribution. We will track Zimbra vendor advisories for follow-on fixes, monitor for additional victim counts and any change to the KEV ransomware-use status, and update this advisory if a second independent source confirms the privilege-escalation or exfiltration stages. Clients who cannot confirm their Zimbra patch level and SNMP package state within 24 hours should contact us for triage support.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.