Zimbra CVE-2026-73570: Unauthenticated RCE Exploited Before Patch

On August 13, 2026, CVE-2026-73570 was disclosed, an unauthenticated command injection vulnerability in Zimbra Collaboration Suite that enables remote code execution via a single SMTP packet. Microsoft Threat Intelligence had already observed active exploitation between July 28 and August 7, when the patch had been available for a week but administrators were unaware of its existence. The severity of the flaw lies not only in the attack mechanism but in a technical detail that misled defenders and researchers: many public proof-of-concept exploits are technically flawed, generating false negatives that make a vulnerable server appear patched.

The Attack Chain: From a Log Line to a Shell as the zimbra User

The mechanism described by Elastic Security Labs follows an apparently simple path that hides subtle complexity. The attacker sends a malformed recipient address in the SMTP RCPT TO command. Postfix logs it in /var/log/zimbra.log, as it does with any other mail event. The Swatchdog daemon, responsible for log monitoring in Zimbra environments with the optional zimbra-snmp package installed and SNMP notifications enabled, matches lines against patterns defined in the swatchrc.in file.

When a line matches, Swatchdog compiles the template into a Perl script. The value of the SERVICE field, extracted from the snmptrap message via the $args{SERVICE} variable, is inserted directly inside Perl backticks and passed to /bin/sh. The absence of sanitization in the log → monitor → shell path transforms every attacker-controlled input into an arbitrary command execution vector.

According to Elastic Security Labs, "one malformed recipient address is enough to trigger it." Execution occurs with the privileges of the zimbra user: "The result is remote code execution as the zimbra user. The account reads every mailbox on the server and sends as any local identity."

"Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path"
— Microsoft Threat Intelligence

The Illusion of Protection: When Public PoCs Lie

A distinctive element of this vulnerability is the gap between appearance and reality in patch validation. Elastic Security Labs verified that "several of the public proofs of concept (PoCs) we tested write a payload that Swatchdog never matches, so a failed test looks like a patched server." The problem is not in the patch, but in the understanding of the format expected by the Swatchdog pattern: public payloads insert commands into the log in a form the daemon does not recognize, so they never trigger the execution phase.

This creates a dual risk. On one hand, attackers relying on generic PoCs may incorrectly conclude a target is protected, abandoning a target that is actually vulnerable. On the other, defenders testing their infrastructure with the same public tools receive a false negative, believing they have fixed the issue when the attack surface remains exposed. Patch validation therefore requires accurate reproduction of the full chain, not mechanical execution of scripts found online.

Pre-Disclosure Exploit: Two Weeks of Unrecognized In-the-Wild Activity

Microsoft Threat Intelligence documented malicious activity in the interval July 28 – August 7, 2026, when Zimbra 10.1.20 was already available but CVE-2026-73570 was not yet public. During this window, "two distinct out-of-band scanning tools" were observed, designed to confirm remote execution without delivering full payloads. The probes performed "local identity checks or dropping a small system fingerprint script," with callbacks to out-of-band interaction domains such as oast.fun, oast.online, dnslog.pp.ua, and requestrepo.com.

It is unclear whether the scanning tools belong to a single actor or multiple distinct groups. Microsoft has not made specific attributions and does not specify the exact number of organizations affected or their precise geographic distribution. What is documented is that victims span "multiple regions and sectors," indicating broad interest rather than a campaign targeting specific verticals.

Observed post-exploitation techniques include JSP webshells, reverse shells, privilege escalation via abuse of zmmailboxdmgr and PAM configurations, systemd persistence with timestomping, and collection of LDAP credentials, MySQL credentials, and Zimbra authentication keys. Microsoft details how in some cases the attacker "replaced the legitimate zmmailboxd.out log with a symlink to the PAM configuration," adding a pam_exec hook and creating a NOPASSWD: ALL entry for the zimbra account.

What to Do Now

• Verify the presence of the zimbra-snmp package and the status of SNMP notifications: the vulnerability is exploitable only when both are active, not on all Zimbra installations.
• Update to Zimbra 10.1.20 or later, released on July 20, 2026, which contains the fix for CVE-2026-73570.
• Validate patch effectiveness with a full technical reproduction of the attack chain documented by Elastic, avoiding reliance on unverified public PoCs that generate false negatives.
• Review /var/log/zimbra.log logs and suspicious SMTP connections in the period July 28 – August 7, 2026, with attention to out-of-band scanning patterns and callbacks to known interaction domains.

The Bigger Problem Than a Malicious Log Line

CVE-2026-73570 is not a vulnerability in the SMTP server or the logging system, but in the implicit assumption that the content of a log file can be safely incorporated into an executable command. Swatchdog is not an exotic component: it is a consolidated monitoring tool that, like many others, applies patterns to logs and reacts with automated actions. The flaw lies at the junction between two apparently independent systems, where the boundary between data and code dissolves without intermediate validation.

The pre-disclosure activity confirms that threat operators actively monitor vendor releases, extracting sufficient information to build functional exploits even without public advisories or complete technical details. The knowledge that a patch exists, combined with analysis of deltas between consecutive versions, provides a measurable time window of days or weeks during which patchable systems remain de facto vulnerable due to a lack of operational awareness.

Frequently Asked Questions

Are all Zimbra versions prior to 10.1.20 vulnerable?

No. The vulnerability requires the optional zimbra-snmp package to be installed and SNMP notifications enabled. Installations without this specific configuration do not expose the documented attack surface.

Why can public PoCs be misleading?

Because Swatchdog applies precise patterns on logs and generic payloads do not always reproduce the format that triggers the match. A test that does not trigger execution is erroneously interpreted as absence of vulnerability, when in reality the server is still exposed to a correctly constructed attack chain.

What does "remote code execution as the zimbra user" mean in terms of impact?

The zimbra user has access to all mailboxes on the server and can impersonate any local identity. According to Microsoft's observations, attackers collected cryptographic keys such as zimbraPreAuthKey and zimbraAuthTokenKey, enabling persistent impersonation even after removal of the initial access.

Sources

• elastic.co
• microsoft.com