Attackers are actively exploiting an unauthenticated command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path, allowing malicious actors to deploy web shells and harvest authentication secrets. Microsoft and the Shadowserver Foundation issued warnings regarding the flaw, tracked as CVE-2026-73570, which affects internet-facing mail servers.
Internet-facing mail servers running the Zimbra Collaboration Suite face an active campaign leveraging an unauthenticated operating system command injection vulnerability. Tracked as CVE-2026-73570 with a CVSS score of 8.9, the flaw allows remote attackers to issue operating system commands without any credentials or user interaction by targeting the Simple Network Management Protocol notification path.
The exploitation vector specifically requires the optional zimbra-snmp package to be installed and SNMP notifications to be enabled on the target server. When a specially crafted SMTP request or email reaches the exposed deployment, untrusted input enters the SNMP notification processing, allowing embedded shell commands to execute with the privileges of the zimbra service account.
Pre-Disclosure Scanning and Discovery of CVE-2026-73570
Zimbra maintainer Synacor issued a patch for the vulnerability on July 20, 2026, as part of version 10.1.20, but the security issue was not publicly disclosed for more than three weeks. Security telemetry indicates that malicious actors probed vulnerable endpoints during that exact window.
Between July 28 and August 7, 2026, Microsoft detected two distinct out-of-band scanning tools probing the internet for vulnerable endpoints. These operators used lightweight out-of-band probes directed at unique subdomains hosted on public collaborator services to validate command execution without immediately delivering a payload.
Active exploitation of the flaw first gained widespread attention when the Polish Computer Emergency Response Team highlighted the campaign in August 2026. The agency advised administrators to review the /var/log/zimbra.log
file for suspicious service restarts and check temporary and web application directories for unauthorized files. Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating that federal agencies apply fixes by August 24, 2026.
Web Shell Deployment and Privilege Escalation Tactics
Once initial command execution was verified, attackers transitioned from reconnaissance to hands-on-keyboard operations and automated payload delivery. Threat actors established persistence and lateral movement capabilities across compromised mail server environments through several distinct methods.
Following successful exploitation, observed activity included deployment of JSP web shells and reverse shells, privilege escalation, persistent remote-access tooling, and memory-backed execution,
Microsoft stated in its analysis.
To maintain access, attackers modified webroot permissions to deploy JavaServer Pages web shells across Jetty and mailboxd application paths. In some cases, operators temporarily enabled write access to public directories to drop the web shells before restoring permissions to evade basic checks.
- Mapping deployment architectures using
zmprovto identify mailbox and Message Transfer Agent nodes. - Modifying the
/etc/pam.d/sudo
configuration file to grant the zimbra service account unrestricted and passwordless sudo access. - Creating a systemd service named
zimlog.serviceto establish execution persistence at system boot. - Using the
zmlocalconfig -scommand to target centralized service and authentication secrets directly on the server. - Utilizing existing SSH identities located at
/opt/zimbra/.ssh/zimbra_identity
alongsidersyncfor lateral movement between trusted nodes.
Credential Harvesting and Remote Access Tooling
Rather than targeting individual mailbox passwords, attackers focused on retrieving high-value authentication attributes. Recovered secrets allowed actors to perform authenticated Lightweight Directory Access Protocol queries for attributes including zimbraPreAuthKey, zimbraAuthTokenKey, and zimbraTwoFactorAuthSecret.
Threat actors also accessed email and collected authentication and mailbox data, with archive creation and subsequent transfer activity observed,
according to Microsoft. Attackers used OpenSSL-encrypted reverse shells to connect to attacker-controlled infrastructure for payload retrieval and exfiltration.
In at least one observed campaign, actors deployed a lightweight shell downloader for a Zimdown2 Go binary, which subsequently installed the Zimclient2 remote-access agent. This agent supported WebSocket, TLS, and raw TCP transports, providing bidirectional file operations and SOCKS5 proxying capabilities.
Current Scale of Compromised Infrastructure
The security-focused Shadowserver Foundation reported that its global scans identified 274 separate instances of the Zimbra Collaboration Suite that had been compromised by attackers exploiting the unauthenticated vulnerability.
Server inventories for the software have fluctuated significantly over the patch lifecycle. Shadowserver tracked roughly 19,000 exposed instances in the week following the July patch release, which declined to approximately 12,000 in subsequent weeks and currently sits near 10,000 tracked instances worldwide.
Microsoft noted that affected organizations span multiple regions and industries, confirming that the attack campaign was not limited to a single geographic area or economic sector.