Zimbra CVE-2026-73570: non-authenticated operation via SMTP with zimbra-snmp displays web shells and data

In recent weeks a campaign was registered that took advantage of a security failure in Zimbra Collaboration Suite to run code without authentication, install web shells and, in several cases, extract data from mail mailboxes. The vulnerability identified as CVE-2026-73570 (CVSS 8.9) affects facilities with the optional zimbra-snmp package and the enabled SNMP notifications; according to public analysis, the operation is carried out by a specially built SMTP request without the need for credentials or user interaction. Zimbra published a patch in July 2026 (version 10.1.20) and security organizations - including Microsoft and CERT Polska - documented active activity before and after correction.

Technically, what is reported in the analyses is a OS command injection not authenticated on the path that receives or processes SNMP notifications associated with the Zimbra service. An attacker who can send mail to the vulnerable server can lead to the execution of commands with the privileges of the Zimbra service account, which has enabled JSP web shells to be deployed over Jetty / mailbox, download binaries by wget / curl, open reverse shells and establish mechanisms of persistence (cron, systemd, memfd _ create, sh keys, shell boot files, etc.). Microsoft described a complete attack chain that includes the discovery of the environment (zmprov), the escalation of privileges by modifying PAM / sudo configurations, the recovery of secrets by zmlocalconfig, the lateral movement taking advantage of Zimbra's SSH identity and exfiltration by means of tools such as AzCopy to cloud storage.

Facts confirmed: CVE-2026-73570 exists and was corrected in Zimbra 10.1.20; the operation can be activated via SMTP without authentication when zimbra-snmp and SNMP notifications are active; actors deployed JSP web shells, reverse shells and remote access tools (e.g. Zimclient2) and collected credentials and mailbox data in multiple environments according to Microsoft telemetry. CERT Polska and CISA issued public warnings and CISA added vulnerability to its Known Exploited Vulnerabilities catalogue, with mitigation deadlines for federal agencies.

Estimated or still uncertain information: The attribution of the intrusions is not publicly confirmed; nor is the total extension of the success of the exfiltrations in all incidents (in at least one case an attempt to transfer to Azure Blob using AzCopy was observed, but the completion of the copy was not confirmed). In addition, although Microsoft described specific techniques observed (modification of / etc / pam.d / sudo, creation of zimlog.service, use of rsync between nodes, etc.), not all affected hosts presented each step of the attack flow.

Who's it to? Any organization that has Zimbra exposed to SMTP traffic and with the zimbra-snmp package installed and the enabled SNMP notifications can be compromised. In particular, deployments with Internet-accessible mailbox / MTA nodes and cluster configurations with shared SSH identity are more vulnerable to lateral exploration and theft of service secrets.

Actual consequences that have been observed: installation of persistent back doors, climbing of zimbra service privileges, theft of secrets (tokens, preauthentication keys, 2FA secrets), removal of Zimbra database tables and archiving of mailbox content. From an operational point of view, this may mean loss of corporate mail confidentiality, commitment of service identities and re-use of credentials to pivote other systems within the same trusted environment.

Specific and immediate measures to be taken by a Zimbra administrator:

(1) Plot or mitigate: apply Zimbra 10.1.20 or the version containing the patch as soon as possible. If you can't park immediately, disinstall zimbra-snmp or disable SNMP notifications and block SNMP access (ports 161 / 162) and SMTP (25) from unreliable sources through access control lists or firewalls. More information about notices and updates on the Zimbra security page: https: / / www.zimbra.com / security /.

2) Verify indicators and persistence: check the records and system for the signals observed by the researchers. Look for unusual restart of service in / var / log / zimbra.log, JSP web shells on Webapps and / tmp routes, recently created files with temporarily altered public permits, suspicious systemd services (e.g. zimlog.service), unexpected cron inputs, SSH keys in / opt / zimbra / .ssh / authorised _ keys and / etc / pam.d / sudo modifications. Useful commands (examples):

grep -i'zimbra '/ var / log / zimbra.log
find / opt / zimbra -type f -iname '* .jsp' -mtime -30
stat / etc / pam.d / sudo

3) Rotation of secrets and containment: take commitment of the service keys and rotate the main secrets of Zimbra (zimbraPreAuthKey, zimbraAuthTokenKey, zimbraTwoFactorAuthSecret), change passwords of service accounts, invalide tokens and consider the rotation of certificates if there are signs of exfiltration. Revocating and regenerating service credentials and restricting the SSH identity of / opt / zimbra / .ssh / zimbra _ identity are critical steps. Any server with signs of engagement should be isolated from the network and preserved for forensic analysis.

4) Search for exfiltration and file transfer devices: monitor outgoing connections using tools such as AzCopy or unusual patterns to cloud storage services. Check the presence of locally archived files (e.g. final.tar.gz mentioned in telemetry) and calls to network utilities that could have transferred data. If you detect attempts to climb to Azure Blob Storage, check logs and set alerts for SAS URL and traffic to block domains. CISA maintains a catalogue of exploited vulnerabilities that can help prioritize actions: https: / / www.cisa.gov / knowledge-exploited-vulnerabilities-catalog.

(5) Recommended recovery: if you confirm commitment, plan reconstruction from clean backups after complete forensic elimination. Do not trust to simply clean the binaries found; the actors have shown multiple mechanisms of persistence and lateral movement that require reimagination or controlled restoration. Documentally and preserve evidence for the investigation.

Finally, although this campaign has been documented in detail by multiple response teams, the visibility is partial and there may be variants or actors reusing the same failure. Maintain detection controls for abnormal command patterns in Zimbra processes, limit unnecessary exposures of administrative services and update monitoring policies to detect changes in PAM / sudo, systemd services and transfer of large volumes of post or database. For additional context and security notices, follow official sources such as Microsoft's security blog: https: / / www.microsoft.com / security / blog / and local CERT equipment for specific indicators.