Attackers Exploit Zimbra Zero-Click Vulnerability to Seize Email Server Control
Microsoft Threat Intelligence reports active exploitation of a command injection flaw in Zimbra, allowing remote takeover of email servers without user interaction.
Key points
- CVE-2026-73570 allows unauthenticated remote code execution on Zimbra servers via crafted email headers.
- Attackers deploy webshells and escalate privileges to gain full control of the underlying operating system.
- Zimbra released a fix in version 10.1.20 on July 20, 2026, before the issue was publicly disclosed.
Microsoft Threat Intelligence has confirmed that threat actors are actively exploiting a zero-click command injection vulnerability in the Zimbra Collaboration Suite. This attack vector allows adversaries to compromise internet-facing email servers without requiring any interaction from users or valid credentials for initial access.
The flaw, identified as CVE-2026-73570, enables attackers to execute arbitrary operating system commands. Security researchers observed these campaigns across multiple industries and geographic regions. The attacks target servers that have the optional zimbra-snmp package installed and have SNMP notifications enabled.
Technical Details and Attack Chain
The vulnerability occurs when malicious SMTP input containing shell metacharacters enters the Zimbra SNMP notification processing pipeline. Specifically, the swatchdog utility incorporates this untrusted input directly into an snmptrap shell invocation. This behavior allows the execution of embedded commands as the Zimbra service account.
Attackers trigger the exploit by sending specially crafted emails. They do not need recipients to open attachments or click links. The mere arrival of the email at the server is sufficient to initiate the command injection sequence. This zero-click nature makes the threat particularly dangerous for automated monitoring systems.
Persistence and Privilege Escalation
After gaining initial access, adversaries deploy JSP webshells within Jetty and mailboxd directories. To avoid detection during routine permission checks, attackers temporarily modify webroot permissions and then restore them to their original state. They also use HTTP, DNS, and ICMP callbacks to verify successful execution.
Some probes included the distinctive ZB73570 User-Agent string. Attackers then escalate privileges by manipulating file ownership and exploiting a pam_exec hook. This technique grants them unrestricted passwordless sudo access. Microsoft noted that attackers restored configuration content while retaining their elevated permissions.
What should you do?
Organizations using Zimbra should immediately verify their version numbers. If the system is not running version 10.1.20 or later, administrators must apply the available update. Those who cannot update immediately should disable SNMP notifications if the zimbra-snmp package is present. Monitor logs for unusual outbound connections or modified webroot permissions.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: Zimbra
- Verify that your Zimbra Collaboration Suite is running version 10.1.20 or newer to ensure the CVE-2026-73570 patch is applied.
- Disable SNMP notifications and uninstall the zimbra-snmp package if immediate patching is not possible to remove the attack vector.
- Inspect Jetty and mailboxd directories for unauthorized JSP files or unexpected changes in file permissions that could indicate webshell deployment.
- Review sudo configurations and pam_exec hooks for signs of manipulation that would allow passwordless privilege escalation by service accounts.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-73570?
It is a command injection vulnerability in Zimbra that allows remote code execution through crafted SMTP input processed by SNMP notifications.
Do users need to click anything for the attack to succeed?
No, the attack is zero-click and relies on the server processing the email headers without any user interaction.
Is there a fix available for this vulnerability?
Yes, Zimbra released a remediation in version 10.1.20 on July 20, 2026.
