CVE-2026-73570 (CVSS score: 8.9) is an unauthenticated operating-system command-injection flaw in Zimbra Collaboration Suite that, when coupled with enabled SNMP notifications and the optional zimbra-snmp package, can lead to remote code execution — and attackers have already weaponized it to plant web shells and harvest mailbox secrets.
How attackers gained entry and what they left behind
Microsoft Security Research found active exploitation of CVE-2026-73570 that began after Zimbra published a patch. The vulnerability can be triggered by a specially crafted SMTP request against exposed Zimbra servers without requiring authentication or user interaction. Zimbra issued a fix in July 2026 with the release of version 10.1.20; Microsoft’s telemetry identified malicious activity between July 20, 2026 (the date 10.1.20 was released) and August 13, 2026 (when the flaw was publicly disclosed).
Microsoft observed initial probing between July 28 and August 7, 2026, when two distinct out-of-band scanning tools validated command execution without delivering payloads. Following successful exploitation, observers recorded the deployment of JSP web shells and reverse shells, privilege escalation, persistent remote-access tooling, and memory-backed execution. As Microsoft summarized: "Following successful exploitation, observed activity included deployment of JSP web shells and reverse shells, privilege escalation, persistent remote-access tooling, and memory-backed execution."
Attack techniques, persistence, and lateral movement
The adversary leveraged the Zimbra environment extensively rather than merely running isolated commands. Microsoft documented multiple techniques:
- Running commands as the "zimbra" service account and deploying multiple JSP web shells across Jetty and mailboxd application paths for redundancy.
- Using wget, curl, and OpenSSL-encrypted reverse shells to retrieve and run additional payloads and to exfiltrate output to attacker-controlled infrastructure.
- Maintaining persistence through cron, systemd services (including a created service named "zimlog.service"), OpenRC, shell startup files, SSH authorized keys, and local account creation.
- Temporarily changing directory write permissions to drop web shells and then restoring permissions to limit visibility during basic checks.
- Exploiting Zimbra’s SSH identity at /opt/zimbra/.ssh/zimbra_identity and using rsync to move web shells and scripts between nodes for cluster-wide compromise.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadWhat data attackers targeted and how they extracted it
Rather than targeting individual mailbox passwords, attackers focused on Zimbra’s centralized service and authentication secrets. Microsoft documented use of the "zmlocalconfig -s" command to recover credentials such as zimbraPreAuthKey, zimbraAuthTokenKey, and zimbraTwoFactorAuthSecret, then using those credentials for authenticated LDAP queries to retrieve high‑value attributes.
Microsoft also described Zimbra‑specific payloads that attempted to read /opt/zimbra/conf/localconfig.xml and construct MySQL and LDAP connection strings to export database contents. Tables targeted for exfiltration included mailbox, mailbox_metadata, mobile_devices, out_of_office, and "all tables in the zimbra.* namespace." Harvested credentials, certificates, LDAP secrets, mail rules, and configuration artifacts were compressed into ZIP archives for transfer.
On one server, the actor archived recent mailbox-backup content into /opt/zimbra/final.tar.gz and then downloaded AzCopy from hxxps://aka[.]ms/downloadazcopy-v10-linux, invoking it with a supplied Azure Blob SAS URL aimed at wsweb03[.]blob[.]core[.]windows[.]net/log/windows.log. Microsoft noted this shows "mailbox-data collection, local archive staging, and an exfiltration attempt using cloud-storage tooling; available evidence does not confirm that the transfer completed successfully."
Timeline, detection guidance, and official responses
Polish CERT Polska first highlighted active exploitation in August 2026, advising administrators to review /var/log/zimbra.log for suspicious Zimbra service restarts and to look for files in temporary and Zimbra webapps directories. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog in August 2026, requiring federal agencies to apply the fixes by August 24, 2026.
Microsoft’s telemetry showed affected organizations across more than one region and industry, though not every host exhibited each stage of the attack chain. Microsoft also observed campaigns that used a lightweight downloader for a Zimdown2 Go binary that installed a Zimclient2 remote-access agent supporting WebSocket, TLS, and raw TCP transports and offering interactive shells, file operations, and SOCKS5 proxying.
Mitigations for operators and the immediate checklist
Microsoft and the advisory authors recommend immediate patching to Zimbra version 10.1.20. Where patching is not feasible, the practical mitigations offered in the reporting include:
- Uninstall the zimbra-snmp package and disable SNMP notifications.
- Restrict SNMP and SMTP access to trusted hosts only.
- Rotate Zimbra authentication secrets and scan servers for redundant web-shell persistence.
How technologists, federal agencies, and Zimbra customers should respond
- Technologists and security teams: apply the July 2026 patch immediately where possible; if not, remove zimbra-snmp, disable SNMP notifications, and hunt for JSP web shells, altered /etc/pam.d/sudo entries, and recently created systemd units like "zimlog.service".
- Federal agencies and regulators: CISA added the CVE to its KEV catalog with an August 24, 2026 remediation requirement — compliance and verification of patch implementation are the necessary next steps.
- Zimbra customers and operators: investigate archive and staging locations such as /opt/zimbra/final.tar.gz, check for AzCopy or other cloud-transfer tooling invocations, and rotate centralized Zimbra secrets after containment.
Microsoft’s findings describe a rapid weaponization of a high-severity, unauthenticated injection flaw that enabled broad post‑exploit activity: web shells, credential harvesting, database exports, and attempted cloud-backed exfiltration. Attribution remains unknown. The immediate, concrete action the reporting supports is simple and urgent — apply the vendor patch or remove the zimbra-snmp attack surface, then treat any signs of access as a potential full-environment compromise.
