Skip to content

Back to the catalog

Tracking CVE-2026-73570: unauthenticated command injection on internet-facing mail servers
microsoft.comwriteup

Tracking CVE-2026-73570: unauthenticated command injection on internet-facing mail servers

Microsoft Threat Intelligence tracked in-the-wild exploitation of CVE-2026-73570, an unauthenticated OS command-injection vulnerability in Zimbra Collaboration Suite's SNMP notification path (swatchdog-to-snmptrap), triggerable via a crafted SMTP request when the optional zimbra-snmp package is enabled. The post documents pre-disclosure scanning, JSP webshell deployment, a novel pam_exec/zmmailboxdmgr privilege-escalation chain to root, systemd-based persistence (zimlog.service), theft of zimbraPreAuthKey/zimbraAuthTokenKey via zmlocalconfig and LDAP, lateral movement over Zimbra's SSH identity, a multi-stage Go-based remote-access agent (zimclient2 via zimdown2/agent2.sh), a dedicated mailbox-exfiltration implant, and an AzCopy-based exfiltration attempt, closing with Defender XDR KQL hunting queries and MITRE ATT&CK mapping.

TL;DR Microsoft details active exploitation of CVE-2026-73570, an unauthenticated command-injection flaw in Zimbra's SNMP notification path, with full attack chain, custom malware, and Defender XDR hunting queries.
Open original ↗
Document

What it is

CVE-2026-73570 is an unauthenticated OS command-injection vulnerability in the SNMP notification path of Zimbra Collaboration Suite, chained from swatchdog to snmptrap. It's exploitable only when the optional zimbra-snmp package is installed and SNMP notifications are enabled.

How it works

A specially crafted SMTP request introduces untrusted input into Zimbra's health-monitoring system. When a service-state change triggers swatchdog, it incorporates the attacker-controlled value into a snmptrap shell invocation without sufficient sanitization, executing embedded shell commands as the zimbra service account. The detection signature: a legitimate snmptrap invocation immediately followed by shell metacharacters and a wget/curl call, wrapped in a trailing # that swallows the remaining legitimate arguments.

Preconditions / Affected

  • Zimbra Collaboration Suite with the optional zimbra-snmp package installed and SNMP notifications enabled.
  • Fixed in Zimbra 10.1.20 (released July 20, 2026). Publicly disclosed August 13, 2026.
  • Microsoft observed scanning and exploitation in the gap between the fix's release and public disclosure (July 28–Aug 7), using out-of-band callback services (oast[.]fun, oast[.]online, dnslog[.]pp[.]ua, requestrepo[.]com, bypass[.]eu[.]org) and a distinctive ZB73570 User-Agent string.

What to do

Patch / reduce exposure

Upgrade to Zimbra Collaboration Suite 10.1.20 or later

If patching must wait: uninstall the zimbra-snmp package, disable SNMP notifications, and restrict SNMP/SMTP access to trusted hosts only.

Contain

  • Treat any reverse-shell alert on an internet-facing mail server as a priority incident, even without a malware detection — the page notes a full mail-store exfiltration attempt in this campaign involved no malware family, only a plain interactive shell.

Rotate and review

  • Rotate all domain zimbraPreAuthKey values (these allow construction of pre-authenticated login URLs for any account) and zimbraAuthTokenKey (signs session tokens; theft enables session forgery for arbitrary accounts without credentials).
  • Audit systemd units for unexpected ownership/timestamps, including ones disguised as logging components (observed artifact name: zimlog.service).
  • Search all Zimbra webroots/servlet-work directories across every mailbox node for JSP webshells and generated *_jsp.java artifacts — one campaign deployed redundant copies across peer nodes specifically to survive single-webshell cleanup.

Hunt

  • Advanced Hunting retains only 30 days; this campaign's pre-disclosure reconnaissance predates that window, so older activity requires searching second-stage infrastructure in Sentinel/archived logs instead.
  • The page provides seven ready-to-run Defender XDR KQL queries covering: the injection boundary itself, suspicious JSP writes, Java/jspawnhelper spawning native shells, memfd-backed execution, PAM/sudo persistence artifacts, DNS callback behavior, and archive/AzCopy exfiltration staging.

Caveats

The page states that command/file matches in its queries "must be interpreted according to the evidence it actually provides" — a query hit confirms execution or a write, not automatically every downstream outcome (e.g., webshell deployment ≠ confirmed activation; archive creation ≠ confirmed successful exfiltration). In the one documented AzCopy case, available evidence does not confirm the transfer completed.

CVEs named here

  • CVE-2026-73570

Technologies named here

  • Zimbra Collaboration Suite
  • Microsoft Defender for Endpoint
  • Microsoft Defender Antivirus
  • zimbra-snmp package
  • Microsoft Defender XDR / Advanced Hunting
  • Microsoft Sentinel
  • Microsoft Security Copilot
  • AzCopy
  • zmlocalconfig / ldapsearch
  • zmprov
  • zmslapcat / slapcat
  • Microsoft Defender XDR
  • Microsoft Defender
  • KQL
  • systemd
  • LDAP
  • Zimbra

Techniques named here

  • Out-of-band scanning / pre-exploitation probing
  • Web shell deployment
  • Reverse shell establishment
  • Account/cluster discovery via Zimbra provisioning tools
  • Privilege escalation via PAM/sudo abuse
  • Credential access via configuration file and LDAP dumping
  • Lateral movement via existing SSH trust relationship
  • Command and control via HTTP/HTTPS and DNS callbacks
  • Multi-stage malware installation with integrity verification
  • Data staging and compression prior to exfiltration
  • Exfiltration over cloud storage service

Threat actors named here

  • Unnamed threat actor exploiting CVE-2026-73570
  • Chopper
  • GodzillaWebShell
  • CoinMiner
  • Looptik
  • SuspGoLang
  • Dirtelti
  • agent2.sh
  • zimdown2
  • zimclient2
  • zimbra-exfil/client-dump
  • Separate credential-dumping malware family

Related in Threat Intel