Zimbra Flaw CVE-2026-73570 Exploited Before Public Disclosure, Microsoft Finds

Flaw lets unauthenticated attackers run remote commands

According to Microsoft’s security research team report, CVE-2026-73570 exists in how Zimbra Collaboration Suite handles SNMP notifications. When the zimbra-snmp package is installed and SNMP notifications are enabled, attackers can inject unfiltered input into the snmptrap command triggered by swatchdog, using a crafted SMTP request (an email). This lets them run arbitrary commands with zimbra service account privileges, without authentication or user interaction.

Zimbra released version 10.1.20 on Jul 20, 2026 to fix the flaw. But the vulnerability was not publicly disclosed until Aug 13 that year. Microsoft’s telemetry shows the attack activity took place in the window between the patch release and the public disclosure.

Attackers scanned and ran full attack chains before disclosure

Microsoft says that between Jul 28 and Aug 7, two different out-of-band scanning tools probed the injection path. They used commands like curl, wget, ping, nslookup and id to verify command execution, but did not deploy follow-up payloads. The goal was only to confirm the flaw could be exploited.

After successful exploitation, attackers planted multiple JSP web shells in the Jetty and mailboxd application paths, maintaining persistence through cron, systemd or memfd_create. They also used Zimbra’s own admin tools to modify the /etc/pam.d/sudo configuration file, granting the zimbra service account passwordless sudo privileges and root access. Microsoft also found attackers creating a systemd service named zimlog.service as a second persistence method.

According to SecurityWeek, citing Microsoft’s report, Poland’s CERT Polska was the first to publicly flag signs of exploitation on Aug 17, 2026, and released indicators of compromise (IoCs). It advised administrators to check /var/log/zimbra.log and Zimbra’s webapps directory for abnormal files.

Attackers targeted centralized authentication keys and mailbox backups

Microsoft’s report says attackers did not steal individual user passwords one by one. Instead, they used the zmlocalconfig -s command to obtain the centralized credentials Zimbra uses for LDAP, MySQL, Postfix and Amavis. They then used these credentials to run authenticated LDAP queries and obtain high-value keys, including zimbraPreAuthKey, zimbraAuthTokenKey and zimbraTwoFactorAuthSecret.

Attackers also used Zimbra’s existing SSH identity credentials to move laterally between other trusted nodes in the cluster, transferring web shells and auxiliary scripts via rsync. Some attack chains deployed a remote access tool named Zimclient2, which supports WebSocket, TLS and raw TCP transport, providing interactive shell access, two-way file operations and SOCKS5 proxy functions. On one compromised server, attackers compressed mailbox backup content into final.tar.gz, then downloaded Microsoft’s official AzCopy tool, attempting to exfiltrate the data via an operator-supplied Azure Blob SAS URL. Current evidence does not confirm whether the transfer was completed.

US cybersecurity agency adds flaw to known exploited list

According to The Hacker News, the US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-73570 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to complete patching by Aug 24, 2026. Microsoft says affected organizations span more than one region and industry, but the identity of the attackers behind the campaign has not been determined. Not every victim host showed every stage of the attack chain.