Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

September 30, 2026 at 09:46 PM1 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Threat actors have exploited a now-patched Zimbra Collaboration Suite flaw to deploy web shells and access mailbox data, Microsoft Security Research reported. The vulnerability, CVE-2026-73570, allows unauthenticated remote code execution when SNMP notifications are enabled. Zimbra patched the flaw in July 2026 with version 10.1.20.

Key Facts

CVE-2026-73570 has a CVSS score of 8.9 and allows unauthenticated OS command injection leading to remote code execution.
Zimbra patched the flaw in July 2026 with the release of version 10.1.20.
CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog in August 2026, requiring federal agencies to apply fixes by August 24, 2026.
Attack activity was observed between July 20, 2026, and August 13, 2026, with scanning tools probing the injection path from July 28 to August 7, 2026.
Attackers deployed JSP web shells, reverse shells, and used cron, systemd, or memfd_create for persistent or memory-backed execution.

Exploitation Chain

Exploitation of CVE-2026-73570 can be triggered by a specially crafted SMTP request against exposed Zimbra servers without requiring authentication or user interaction. Microsoft observed deployment of JSP web shells and reverse shells, privilege escalation, persistent remote-access tooling, and memory-backed execution. Attackers ran commands as the 'zimbra' service account and deployed multiple JSP web shells across Jetty and mailboxd application paths for redundancy. Other execution chains used cron, systemd, or memfd_create to maintain recurring or memory-backed execution.

Detection and Response

CERT Polska first highlighted active exploitation in August 2026, urging users to review /var/log/zimbra.log for suspicious service restarts and check temporary and webapps directories. CISA added the flaw to its Known Exploited Vulnerabilities catalog later that month, mandating federal agencies apply fixes by August 24, 2026. Microsoft identified attack activity between July 20, 2026, and August 13, 2026, with two distinct out-of-band scanning tools probing the injection path from July 28 to August 7, 2026.