DEV Community

Anoymask
Anoymask

Posted on

Zimbra CVE-2026-73570: Unauthenticated Command Injection via SMTP

#security #threatintel

1. Basic Information

2. Summary in One Sentence

An actively exploited vulnerability allows attackers to send a crafted SMTP request to Zimbra servers with SNMP notifications enabled and execute OS commands as the zimbra user without authentication.

Reason for Severity: Attackers can reach the mail infrastructure without authentication, and active exploitation has been confirmed on the internet. Compromising a Zimbra server provides a foothold for accessing emails, credentials, and the internal network.

3. Attack Flow

Command Execution from SMTP

  1. An attacker finds a vulnerable server that is reachable via SMTP, has zimbra-snmp installed, and has SNMP notifications enabled.
  2. The attacker sends a crafted SMTP request to inject malicious strings into the service status notification.
  3. The swatchdog / SNMP notification process does not handle the strings safely and executes them as OS commands.
  4. The commands run with the privileges of the zimbra user and can place files in web directories or temporary directories.
  5. The attacker may proceed to install web shells, deploy additional tools, or retrieve emails and configuration data.

4. Attacker Position and Execution Location

  • An unauthenticated attacker connecting to Zimbra's SMTP service from the internet
  • Command execution on the Zimbra server using the zimbra OS user privileges
  • Potential subsequent remote control of the server via web shells or external C2

5. Visibility for Victims and Administrators

Victims / Users

  • No user action is required. Compromise can occur on the server side even if email sending and receiving appear normal.

Administrators / SOC

  • Clues include unusual "Service status change" entries in /var/log/zimbra.log, new files owned by the zimbra user, and child processes or outbound connections immediately following SMTP traffic.

6. Conditions for Success and Failure

Conditions for Success

  • Vulnerable Zimbra has zimbra-snmp and SNMP notifications enabled.
  • The attacker can reach the SMTP service.
  • The zimbra user has write/execution permissions in accessible locations, and outbound network traffic is allowed.

Conditions for Failure

  • Update to ZCS 10.1.20 or later.
  • Disable the SNMP notification feature until patches are applied.
  • Control SMTP exposure, process execution, web directory write access, and egress traffic.
  • Detect crafted notifications early through log monitoring.

7. What Happens Upon Success

  • Arbitrary OS commands executed with zimbra user privileges.
  • Placement of web shells or additional malware.
  • Access to emails, address books, configurations, and credentials.
  • Establishment of a foothold in the internal network.

8. Observable Logs

Email

  • Check SMTP sessions and commands, not just normal incoming emails. Exploitation requests may not be delivered to user mailboxes.

Proxy / SWG / DNS

  • Tool downloads or C2 connections from the Zimbra server to unknown IP addresses or domains.

Endpoint / EDR

  • Shells, curl/wget, and file creation under the Zimbra/SNMP notification process.
  • New files owned by the zimbra user in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/.

Identity / IdP

  • Suspicious logins by Zimbra administrators or mail accounts, authentication tokens, and password changes.

SaaS / Cloud

  • If Zimbra is hosted in the cloud, check for the use of instance roles or snapshot modifications. Cloud exploitation has not been confirmed in public reports.

Network

  • External SMTP requests, C2 connections from Zimbra, and connections to internal IMAP, LDAP, or management ports.

9. Determining Attack Success

  • Attack attempt observed (Success unconfirmed): Observed known-pattern SMTP requests or Service status change strings, but no child processes or file creation.
  • Initial execution confirmed: Confirmed OS commands or child processes under the Zimbra/SNMP notification process.
  • Malware execution or authentication success confirmed: Confirmed web shell/additional tool execution or unauthorized account/session usage.
  • Information theft or session compromise confirmed: Confirmed reading, staging, and exfiltration of emails, configurations, or credentials.
  • Subsequent compromise confirmed: Connections to internal hosts, compromise of other accounts, or persistence.

"Attack attempt observed (Success unconfirmed)" means suspicious requests or artifacts were seen, but it does not mean code execution or data theft succeeded. Elevate the stage based on subsequent evidence.

10. Investigation Playbook

Trigger

  • SMTP requests matching CVE-2026-73570 exploitation patterns.
  • Unusual "Service status change" entries in zimbra.log.
  • Shells or outbound connections under Zimbra processes.

Initial Check

  • Check the status of the Zimbra version, zimbra-snmp, snmp_notify, and swatchdog.
  • Identify the timestamp of the first suspicious SMTP request and the corresponding log lines.

Endpoint

  • Preserve zimbra.log, audit logs, process history, web directories, /tmp, cron jobs, and services.
  • Investigate files created in the last 30 days that are owned by the zimbra user.

Authentication & Cloud

  • Check administrator and user logins, mail forwarding, authentication tokens, and LDAP access.
  • If deployed in the cloud, check instance roles and management APIs.

Subsequent Activity

  • Investigate web shells, additional binaries, outbound connections, and internal LDAP/file share access.
  • Search all Zimbra servers for the same SMTP sender and IOCs.

Containment

  • Limit SMTP and management access to the bare minimum and update to 10.1.20 or later.
  • Isolate suspected compromised servers, rotate accounts and secrets, and consider rebuilding.

Judgment Categories

  • Attack requests only
  • OS command execution confirmed
  • Web shell / authentication compromise confirmed
  • Email / credential theft confirmed
  • Internal subsequent compromise confirmed

11. Defense and Detection Ideas

Single Event

  • Shell meta-characters, URLs, or commands in zimbra.log under Service status change.
  • Shell, curl, or wget spawned from Zimbra/SNMP parent processes.
  • Executable files owned by the zimbra user in web directories or /tmp.

Timeline Correlation

  • Crafted SMTP -> Service status change -> Child process -> File creation -> Outbound connection -> Suspicious email / LDAP access.

Threat Hunting Perspectives

  • Files owned by the zimbra user and web shells created in the last 30 days.
  • Outbound connections and internal management port connections from Zimbra processes.
  • Forwarding rules, administrator changes, and authentication token changes after the exploit timestamp.

Log Gaps

  • Complete SMTP sessions, process command lines, file audits, Zimbra audits, and east-west network traffic.

Priority Countermeasures

  • Urgently update to 10.1.20 or later.
  • Stop unnecessary SNMP notifications.
  • Monitor egress traffic from Zimbra and write access to web directories.
  • Correlate email, authentication, and endpoint logs chronologically.

12. Facts / Inference / Hypothesis

Facts

  • CVE-2026-73570 is an unauthenticated command injection vulnerability in Zimbra's SNMP notification handling.
  • Configurations with zimbra-snmp and SNMP notifications enabled are affected.
  • Crafted SMTP requests can execute commands with zimbra user privileges.
  • Fixed in ZCS 10.1.20.
  • CERT Polska and others have confirmed active exploitation.

Inference

  • Overlooking SMTP and server processes instead of focusing solely on email delivery success can cause defenders to miss exploitation.
  • Even with zimbra privileges, attackers can achieve severe impact through email, configuration, and internal network access.

Hypothesis

  • After initial access, attackers may increasingly use web shells or credentials to monitor emails and perform internal lateral movement.

13. MITRE ATT&CK Mapping

  • T1190 – Exploit Public-Facing Application (High Confidence)
  • T1059.004 – Command and Scripting Interpreter: Unix Shell (High Confidence)
  • T1505.003 – Server Software Component: Web Shell (Medium Confidence): Potential placement and investigation focus. Confirmation in specific active exploits has not been publicly detailed.
  • T1105 – Ingress Tool Transfer (Medium Confidence)
  • T1114 – Email Collection (Medium Confidence): Possible after compromise, but not necessarily confirmed in all public cases.

14. Unknowns and Additional Investigation

  • Threat actors, number of targets, and post-exploitation payloads.
  • Actual scope of email theft and lateral movement.
  • All IOCs and the attack start date.

15. Impact on SOCs and Organizations

Email infrastructure is a high-value asset, and Zimbra is widely used globally. Organizations should prioritize asset inventory for affected configurations, emergency updates, and correlation of SMTP logs with process logs, while distinguishing between mere scanning traffic and actual OS command execution.

16. Summary by Role

For SOCs

Review SMTP, zimbra.log, child processes, web directories, and authentication/email operations in chronological order.

For Administrators

Update to 10.1.20 or later and disable unnecessary SNMP notifications until patched.

For Users

No user action is required. Report any suspicious email behavior to administrators.

Top comments (0)