Unauthenticated Command Injection in Zimbra Collaboration Suite Exploited in the Wild
Microsoft Threat Intelligence tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in Zimbra Collaboration Suite, impacting internet-facing mail servers.
Microsoft Threat Intelligence has identified and is tracking the exploitation of CVE-2026-73570, a critical unauthenticated OS command injection vulnerability affecting the Zimbra Collaboration Suite. This flaw resides within the SNMP notification path of the software. Exploitation is possible through a specially crafted email sent to internet-facing Zimbra servers, provided the optional zimbra-snmp package is installed and SNMP notifications are enabled. Crucially, the attack requires no authentication and no user interaction to succeed.
Successful exploitation allows attackers to gain significant control over compromised servers. Observed malicious activities include the deployment of JavaServer Pages (JSP) web shells and reverse shells, enabling persistent remote access. Threat actors have also been observed accessing sensitive email data, collecting authentication credentials, and exfiltrating mailbox contents. The attacks have involved both automated payload delivery and hands-on-keyboard operations by adversaries.
The vulnerability, CVE-2026-73570, allows an attacker to inject shell metacharacters into an SMTP request, which are then processed by Zimbra's SNMP notification system. If the input is not properly sanitized, embedded commands can be executed with the privileges of the zimbra service account. The vulnerability was publicly disclosed on August 13, 2026, but Microsoft telemetry indicates that exploitation attempts began as early as July 28, 2026, after a fix was available on July 20, 2026, in Zimbra version 10.1.20.
Prior to the public disclosure, Microsoft observed two distinct out-of-band scanning tools probing the vulnerable injection point between July 28 and August 7. These probes used lightweight requests to validate command execution by checking local identity or dropping small scripts, often using collaborator services for callback verification. This reconnaissance phase demonstrated the attackers' intent to confirm exploitability before launching full-scale attacks.
The attack chain typically begins with a crafted SMTP request that triggers the command injection. Attackers then leverage this initial access to deploy JSP web shells. This often involves modifying webroot permissions, reconstructing encoded payloads from fragments, and writing them to publicly accessible directories. In some instances, attackers downloaded and executed content directly using tools like wget or curl, or established interactive reverse shells.
Persistence mechanisms varied, with attackers employing cron jobs, systemd services, or memory-backed execution techniques like memfd_create. Multiple JSP web shells were deployed across different application paths, including Jetty and mailboxd, to ensure continued access and resilience against detection. Attackers also took steps to limit the visibility of their actions, such as temporarily enabling write access to public directories and then restoring original permissions.
Post-exploitation, attackers focused on reconnaissance within the compromised environment. They utilized Zimbra's zmprov tool to map server roles and identify mailboxes and Mail Transfer Agents (MTAs). Additionally, they checked for existing administrative trust through Zimbra SSH identities to facilitate lateral movement within the network. DNS-based callbacks were used to exfiltrate environment details, including server counts and other system information.
Microsoft observed affected organizations across multiple regions and industries, indicating a widespread impact. The observed activity was not confined to a single sector or geographic area, highlighting the broad applicability of this vulnerability. The analysis combines behaviors observed across various confirmed compromises, with no single host exhibiting every stage of the attack chain.
This new report from Microsoft Security Research details the specific post-exploitation activities observed after CVE-2026-73570 was weaponized, including the deployment of JSP and reverse web shells, privilege escalation, and the harvesting of authentication secrets like zimbraPreAuthKey and zimbraAuthTokenKey. The analysis also highlights the use of a Go-based implant for credential extraction and the deployment of a remote access agent named Zimclient2, offering further insight into the threat actor's toolkit and persistence methods.
This new report details the specific attack chain observed by Microsoft Threat Intelligence, including the deployment of web shells, stolen credentials, and persistent remote access tools. The attackers leveraged the CVE-2026-73570 vulnerability to gain initial access, then proceeded with hands-on keyboard activity to establish deeper persistence and exfiltrate data, impacting multiple regions and industries.
The article provides further details on the exploitation of CVE-2026-73570, noting that attackers deployed JSP webshells across various application paths and utilized legitimate Zimbra tools for privilege escalation to root. Furthermore, the attackers established a secondary persistence mechanism using a systemd service named zimlog.service and exfiltrated centralized service and authentication secrets for further lateral movement and credential harvesting.
This new report from Microsoft Threat Intelligence details how attackers were actively exploiting CVE-2026-73570 in Zimbra Collaboration Suite for weeks before its public disclosure. The exploitation involved gaining initial access, deploying web shells, stealing credentials, and exfiltrating mailbox data, with some attackers attempting to cover their tracks by restoring directory permissions. The vulnerability specifically affects Zimbra servers running the optional SNMP monitoring package with notifications enabled.