Microsoft Tracks Active Exploitation of Zimbra Mail Servers Through CVE-2026-73570

Microsoft Tracks CVE-2026-73570 Attacks Against Internet-Facing Zimbra Servers

Microsoft Threat Intelligence has detailed active exploitation of CVE-2026-73570, an unauthenticated operating-system command-injection vulnerability affecting the Zimbra Collaboration Suite.

The vulnerability resides in Zimbra's SNMP notification path. According to Microsoft, exploitation can be triggered through a specially crafted SMTP request when the optional zimbra-snmp package is installed and SNMP notifications are enabled. No authentication or user interaction is required.

Microsoft's investigation found activity ranging from initial command-execution testing to web-shell deployment, privilege escalation, persistence, credential collection, lateral movement and attempts to collect mailbox data.

The company observed affected organisations across more than one region and industry. Microsoft also notes that its attack-chain diagram combines behaviours from multiple confirmed compromises, meaning that every stage was not necessarily present on every affected host.

Zimbra Had Already Released a Fix

Zimbra released version 10.1.20 on July 20, 2026, containing the relevant remediation for CVE-2026-73570.

The vulnerability was publicly disclosed on August 13, 2026. Microsoft said its telemetry identified activity targeting the vulnerable injection path between those two dates.

This timeline is particularly relevant because Microsoft observed probing after the remediation was available but before public disclosure.

Between July 28 and August 7, Microsoft identified two distinct out-of-band scanning tools probing the vulnerable injection point.

The probes were designed to establish whether command execution was possible. Microsoft observed HTTP, DNS and ICMP-based callbacks as well as identity checks. The activity could validate command execution without immediately delivering a full payload.

How the Command Injection Worked

CVE-2026-73570 involves the processing of attacker-controlled input in Zimbra's SNMP notification workflow.

Microsoft explains that a specially crafted SMTP request can introduce untrusted input into SNMP notification processing. When a service-state change triggers health monitoring, swatchdog incorporates the attacker-controlled value into an snmptrap shell invocation.

This allows shell commands to execute with the privileges of the Zimbra service account. Exploitation depends on the optional zimbra-snmp package being installed and SNMP notifications being enabled.

The initial command execution became the entry point for a much broader post-exploitation sequence.

Attackers used the access to deploy JSP web shells, execute downloaded content, launch background processes and establish reverse shells. Microsoft also observed execution involving cron, systemd and memfd_create.

Web Shells Provided Persistent Access

Following exploitation, attackers deployed multiple JSP web shells across Zimbra application paths.

Microsoft observed attackers temporarily changing permissions on publicly accessible directories, placing web-shell content there, and subsequently restoring the permissions. This could reduce the visibility of the modification during basic permission checks.

Multiple copies were also observed across Jetty and mailboxd application paths, including peer mailbox nodes.

This meant that removing one web shell would not necessarily remove every access mechanism observed during the incidents.

Attackers Mapped the Zimbra Environment

After obtaining command execution, the attackers performed environment discovery.

Microsoft observed use of Zimbra's zmprov utility to identify mailbox and MTA nodes. The attackers also checked for the Zimbra SSH identity, apparently looking for existing administrative trust that could enable movement between Zimbra systems.

DNS callbacks were also used to transmit environment information, including mailbox-server counts and other host-specific details.

This shows that the exploitation activity was not limited to executing a single command. The observed attackers continued with environment discovery and attempted to understand the structure of the Zimbra deployment.

Privilege Escalation to Root

Microsoft also documented a privilege-escalation path involving legitimate Zimbra service components and the system's PAM configuration.

The observed technique involved a writable Zimbra log path, zmmailboxdmgr, zmstat-fd, pam_exec and the sudo PAM configuration.

According to Microsoft, the attackers manipulated these components so that a PAM session hook could execute with root privileges. This ultimately allowed the attackers to create a NOPASSWD: ALL entry for the zimbra account and obtain unrestricted sudo access.

The attackers subsequently restored the original PAM content and removed temporary artifacts while retaining the resulting sudo access.

Microsoft also observed a second persistence mechanism involving a systemd service named zimlog.service. The service was installed outside normal Zimbra application directories and enabled to execute at system boot.

Authentication Secrets Became a Target

The attackers did not limit their credential activity to individual mailbox passwords.

Microsoft observed use of Zimbra's zmlocalconfig -s utility to expose credentials associated with services including LDAP, MySQL, Postfix, Amavis and replication.

Those credentials were then used for LDAP queries that retrieved authentication-related attributes including:

• zimbraPreAuthKey

• zimbraAuthTokenKey

• zimbraTwoFactorAuthSecret

Microsoft said portions of the collected information were compressed into hidden archives.

The research also describes a separate credential-dumping malware family that collected Zimbra configuration credentials and authentication material through an automated backdoor.

Lateral Movement Across Zimbra Nodes

The attackers also leveraged Zimbra's existing SSH identity to move between trusted nodes.

Microsoft observed use of:

/opt/zimbra/.ssh/zimbra_identity

SSH connections were used to access other nodes, while rsync was used to move payload fragments, helper scripts and JSP web shells between systems.

This is significant for administrators operating clustered Zimbra environments because compromise of one exposed server can become a starting point for activity against other trusted nodes.

Mailbox Data Collection and Exfiltration Attempt

Microsoft also observed collection and staging of mailbox-related data.

On one compromised server, the attackers archived recent mailbox-backup content into:

/opt/zimbra/final.tar.gz

They subsequently downloaded Microsoft's AzCopy utility and invoked it with an Azure Blob SAS URL in an attempted transfer.

Microsoft explicitly states that the available evidence does not confirm that the transfer completed successfully.

This distinction is important. The investigation provides evidence of collection, staging and an attempted transfer, but does not establish that the collected information was successfully exfiltrated.

Microsoft's Recommended Mitigations

Microsoft recommends upgrading Zimbra Collaboration Suite installations to version 10.1.20 or later, which remediates CVE-2026-73570.

Where patching has to wait, Microsoft recommends:

• Uninstalling the optional zimbra-snmp package

• Disabling SNMP notifications

• Restricting SNMP and SMTP access to trusted hosts

Organisations should also investigate internet-facing Zimbra servers for signs of compromise.

Microsoft specifically recommends treating reverse-shell alerts on internet-facing mail servers as priority incidents and reviewing persistence mechanisms rather than relying only on malware detections.

Security teams should also rotate Zimbra authentication secrets and inspect systemd services for unexpected ownership, enablement or timestamp changes.

Microsoft recommends looking for unexpected JSP files and generated servlet artifacts across Zimbra application and servlet-work directories, including on mailbox nodes where redundant web-shell persistence may have been established.

Detection and Threat Hunting

Microsoft's research includes behaviour-based detection and Advanced Hunting queries for organisations using Microsoft Defender.

The hunting guidance covers several stages of the observed activity, including:

• SNMP command-injection behaviour

• Suspicious JSP writes

• Java or jspawnhelper launching native shells

• Memory-backed execution

• Persistence mechanisms

• Privilege-escalation activity

• DNS callbacks

• Collection and cloud-transfer activity

Microsoft also notes that security teams should not depend exclusively on named malware detections. Some of the consequential activity observed in the campaign involved interactive shell access rather than a specific malware family.

What This Means for Mail-Server Security

Analysis: The incident highlights the importance of treating internet-facing collaboration and mail infrastructure as high-value security assets. A vulnerability that initially provides command execution can become considerably more consequential when attackers can establish persistence, obtain service credentials, move between trusted nodes and access mailbox-related data.

The research also demonstrates why patching should be accompanied by post-patch investigation when exploitation may have occurred before or around disclosure. Applying the fixed version addresses the vulnerability, but it does not by itself establish whether an attacker previously obtained access.

For organisations running Zimbra, the practical response therefore involves two parallel activities: remediating the vulnerable software and checking whether the environment was already compromised.

Microsoft's investigation provides specific hunting opportunities that can help defenders connect the initial command-injection behaviour with later web-shell, persistence, credential-access and data-collection activity.

Bottom Line

CVE-2026-73570 demonstrates how an unauthenticated vulnerability in an internet-facing mail server can lead to a broader compromise chain.

Microsoft observed attackers moving from command-execution validation to web shells, privilege escalation, persistence, credential and authentication-secret collection, lateral movement and attempted mailbox-data transfer.

Zimbra 10.1.20 or later contains the relevant remediation, while Microsoft recommends additional exposure-reduction and investigation steps for organisations that cannot immediately patch or may already have been targeted.