--- url: "https://www.xcademia.com/news/microsoft-tracks-active-exploitation-of-zimbra-mail-servers-through-cve-2026-73570" title: "Microsoft Tracks Active Exploitation of Zimbra Mail Servers Through CVE-2026-73570" description: "Microsoft tracks active exploitation of Zimbra CVE-2026-73570, revealing web shells, privilege escalation, credential theft and mailbox-data collection." publishedAt: "2026-10-01T09:59:44.728+00:00" updatedAt: "2026-10-11T12:05:50.24039+00:00" type: news category: cybersecurity source_name: Microsoft Security Research / Microsoft Threat Intelligence source_url: "https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/" tags: - "#Cybersecurity" - "#Zimbra" - "#CVE202673570" - "#Vulnerability" - "#CommandInjection" - "#EmailSecurity" - "#ThreatIntelligence" - "#WebShell" --- # Microsoft Tracks Active Exploitation of Zimbra Mail Servers Through CVE-2026-73570 > Microsoft has documented exploitation of CVE-2026-73570, an unauthenticated command-injection flaw in Zimbra. Attackers used it to deploy web shells, escalate privileges, access authentication secrets and attempt mailbox-data collection. Source: **Microsoft Security Research / Microsoft Threat Intelligence** · 1 October 2026 ## Microsoft Tracks CVE-2026-73570 Attacks Against Internet-Facing Zimbra Servers Microsoft Threat Intelligence has detailed active exploitation of **CVE-2026-73570**, an unauthenticated operating-system command-injection vulnerability affecting the **Zimbra Collaboration Suite**. The vulnerability resides in Zimbra's SNMP notification path. According to Microsoft, exploitation can be triggered through a specially crafted SMTP request when the optional `zimbra-snmp` package is installed and SNMP notifications are enabled. No authentication or user interaction is required. Microsoft's investigation found activity ranging from initial command-execution testing to web-shell deployment, privilege escalation, persistence, credential collection, lateral movement and attempts to collect mailbox data. The company observed affected organisations across more than one region and industry. Microsoft also notes that its attack-chain diagram combines behaviours from multiple confirmed compromises, meaning that every stage was not necessarily present on every affected host. ## Zimbra Had Already Released a Fix Zimbra released **version 10.1.20 on July 20, 2026**, containing the relevant remediation for CVE-2026-73570. The vulnerability was publicly disclosed on **August 13, 2026**. Microsoft said its telemetry identified activity targeting the vulnerable injection path between those two dates. This timeline is particularly relevant because Microsoft observed probing after the remediation was available but before public disclosure. Between **July 28 and August 7**, Microsoft identified two distinct out-of-band scanning tools probing the vulnerable injection point. The probes were designed to establish whether command execution was possible. Microsoft observed HTTP, DNS and ICMP-based callbacks as well as identity checks. The activity could validate command execution without immediately delivering a full payload. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790848724302-info1--103-.webp) ## How the Command Injection Worked CVE-2026-73570 involves the processing of attacker-controlled input in Zimbra's SNMP notification workflow. Microsoft explains that a specially crafted SMTP request can introduce untrusted input into SNMP notification processing. When a service-state change triggers health monitoring, `swatchdog` incorporates the attacker-controlled value into an `snmptrap` shell invocation. This allows shell commands to execute with the privileges of the Zimbra service account. Exploitation depends on the optional `zimbra-snmp` package being installed and SNMP notifications being enabled. The initial command execution became the entry point for a much broader post-exploitation sequence. Attackers used the access to deploy JSP web shells, execute downloaded content, launch background processes and establish reverse shells. Microsoft also observed execution involving `cron`, `systemd` and `memfd_create`. ## Web Shells Provided Persistent Access Following exploitation, attackers deployed multiple JSP web shells across Zimbra application paths. Microsoft observed attackers temporarily changing permissions on publicly accessible directories, placing web-shell content there, and subsequently restoring the permissions. This could reduce the visibility of the modification during basic permission checks. Multiple copies were also observed across Jetty and mailboxd application paths, including peer mailbox nodes. This meant that removing one web shell would not necessarily remove every access mechanism observed during the incidents. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790848740792-info2--104-.webp) ## Attackers Mapped the Zimbra Environment After obtaining command execution, the attackers performed environment discovery. Microsoft observed use of Zimbra's `zmprov` utility to identify mailbox and MTA nodes. The attackers also checked for the Zimbra SSH identity, apparently looking for existing administrative trust that could enable movement between Zimbra systems. DNS callbacks were also used to transmit environment information, including mailbox-server counts and other host-specific details. This shows that the exploitation activity was not limited to executing a single command. The observed attackers continued with environment discovery and attempted to understand the structure of the Zimbra deployment. ## Privilege Escalation to Root Microsoft also documented a privilege-escalation path involving legitimate Zimbra service components and the system's PAM configuration. The observed technique involved a writable Zimbra log path, `zmmailboxdmgr`, `zmstat-fd`, `pam_exec` and the sudo PAM configuration. According to Microsoft, the attackers manipulated these components so that a PAM session hook could execute with root privileges. This ultimately allowed the attackers to create a `NOPASSWD: ALL` entry for the `zimbra` account and obtain unrestricted sudo access. The attackers subsequently restored the original PAM content and removed temporary artifacts while retaining the resulting sudo access. Microsoft also observed a second persistence mechanism involving a systemd service named `zimlog.service`. The service was installed outside normal Zimbra application directories and enabled to execute at system boot. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790848760514-info3--103-.webp) ## Authentication Secrets Became a Target The attackers did not limit their credential activity to individual mailbox passwords. Microsoft observed use of Zimbra's `zmlocalconfig -s` utility to expose credentials associated with services including LDAP, MySQL, Postfix, Amavis and replication. Those credentials were then used for LDAP queries that retrieved authentication-related attributes including: - `zimbraPreAuthKey` - `zimbraAuthTokenKey` - `zimbraTwoFactorAuthSecret` Microsoft said portions of the collected information were compressed into hidden archives. The research also describes a separate credential-dumping malware family that collected Zimbra configuration credentials and authentication material through an automated backdoor. ## Lateral Movement Across Zimbra Nodes The attackers also leveraged Zimbra's existing SSH identity to move between trusted nodes. Microsoft observed use of: `/opt/zimbra/.ssh/zimbra_identity` SSH connections were used to access other nodes, while `rsync` was used to move payload fragments, helper scripts and JSP web shells between systems. This is significant for administrators operating clustered Zimbra environments because compromise of one exposed server can become a starting point for activity against other trusted nodes. ## Mailbox Data Collection and Exfiltration Attempt Microsoft also observed collection and staging of mailbox-related data. On one compromised server, the attackers archived recent mailbox-backup content into: `/opt/zimbra/final.tar.gz` They subsequently downloaded Microsoft's **AzCopy** utility and invoked it with an Azure Blob SAS URL in an attempted transfer. Microsoft explicitly states that the available evidence **does not confirm that the transfer completed successfully**. This distinction is important. The investigation provides evidence of collection, staging and an attempted transfer, but does not establish that the collected information was successfully exfiltrated. ## Microsoft's Recommended Mitigations Microsoft recommends upgrading Zimbra Collaboration Suite installations to **version 10.1.20 or later**, which remediates CVE-2026-73570. Where patching has to wait, Microsoft recommends: - Uninstalling the optional `zimbra-snmp` package - Disabling SNMP notifications - Restricting SNMP and SMTP access to trusted hosts Organisations should also investigate internet-facing Zimbra servers for signs of compromise. Microsoft specifically recommends treating reverse-shell alerts on internet-facing mail servers as priority incidents and reviewing persistence mechanisms rather than relying only on malware detections. Security teams should also rotate Zimbra authentication secrets and inspect systemd services for unexpected ownership, enablement or timestamp changes. Microsoft recommends looking for unexpected JSP files and generated servlet artifacts across Zimbra application and servlet-work directories, including on mailbox nodes where redundant web-shell persistence may have been established. ## Detection and Threat Hunting Microsoft's research includes behaviour-based detection and Advanced Hunting queries for organisations using Microsoft Defender. The hunting guidance covers several stages of the observed activity, including: - SNMP command-injection behaviour - Suspicious JSP writes - Java or `jspawnhelper` launching native shells - Memory-backed execution - Persistence mechanisms - Privilege-escalation activity - DNS callbacks - Collection and cloud-transfer activity Microsoft also notes that security teams should not depend exclusively on named malware detections. Some of the consequential activity observed in the campaign involved interactive shell access rather than a specific malware family. ## What This Means for Mail-Server Security **Analysis:** The incident highlights the importance of treating internet-facing collaboration and mail infrastructure as high-value security assets. A vulnerability that initially provides command execution can become considerably more consequential when attackers can establish persistence, obtain service credentials, move between trusted nodes and access mailbox-related data. The research also demonstrates why patching should be accompanied by post-patch investigation when exploitation may have occurred before or around disclosure. Applying the fixed version addresses the vulnerability, but it does not by itself establish whether an attacker previously obtained access. For organisations running Zimbra, the practical response therefore involves two parallel activities: **remediating the vulnerable software and checking whether the environment was already compromised**. Microsoft's investigation provides specific hunting opportunities that can help defenders connect the initial command-injection behaviour with later web-shell, persistence, credential-access and data-collection activity. ## Bottom Line CVE-2026-73570 demonstrates how an unauthenticated vulnerability in an internet-facing mail server can lead to a broader compromise chain. Microsoft observed attackers moving from command-execution validation to web shells, privilege escalation, persistence, credential and authentication-secret collection, lateral movement and attempted mailbox-data transfer. Zimbra **10.1.20 or later** contains the relevant remediation, while Microsoft recommends additional exposure-reduction and investigation steps for organisations that cannot immediately patch or may already have been targeted. ## Original source https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/ ## Tags `#Cybersecurity` · `#Zimbra` · `#CVE202673570` · `#Vulnerability` · `#CommandInjection` · `#EmailSecurity` · `#ThreatIntelligence` · `#WebShell` --- ## About this content This Markdown news article is the citation-grade twin of [Microsoft Tracks Active Exploitation of Zimbra Mail Servers Through CVE-2026-73570](https://www.xcademia.com/news/microsoft-tracks-active-exploitation-of-zimbra-mail-servers-through-cve-2026-73570). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/microsoft-tracks-active-exploitation-of-zimbra-mail-servers-through-cve-2026-73570 - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt