--- schema: 1 kind: vulnerability title: "CVE-2026-73570, Zimbra Collaboration: a pre-auth command injection patched without a CVE in July is exploited, with probing before disclosure and root escalation, secret theft and cluster-wide movement observed" headline: "Fixed on 20 July, identified on 13 August, probed from 28 July: a CVE-keyed patch process never saw this one coming" summary: > Zimbra shipped ZCS 10.1.20 on 2026-07-20 with a fix for a command injection in the SNMP monitoring component, and the identifier CVE-2026-73570 followed on 2026-08-13. Microsoft Threat Intelligence now reports confirmed intrusions in more than one region and industry, with probing of the injection point from 2026-07-28, before disclosure, and CISA lists the flaw in KEV (added 2026-08-21). The flaw needs no authentication and applies only where the optional zimbra-snmp package is installed and SNMP notifications are enabled; Microsoft's cases combined web shells, root escalation, theft of Zimbra's authentication keys and cluster-wide movement, so an upgrade does not evict an attacker already inside. CSIRT Italia reports that exploitation of this flaw has also led to ELock-family ransomware, cryptomining and theft of the LDAP database and credential hashes on exposed servers, and found no intrusion on regularly updated instances. discovered_at: "2026-08-20T04:36:00Z" updated_at: "2026-10-06T05:00:00Z" event_date: "2026-08-18" run_id: 2026-08-20T0409Z-intel priority: high immediate_action: null tags: [vulnerabilities, rce, pre-auth, actively-exploited, cisa-kev, patch-available, ransomware] regions: [global, europe] sectors: [public-sector, education, telco] entities: ["product:zimbra-collaboration", "malware:elock"] techniques: [T1190, T1059.004, T1595.002, T1105, T1505.003, T1548.003, T1543.002, T1053.003, T1620, T1036.005, T1070.006, T1552.001, T1021.004, T1570, T1090, T1071.001, T1114.001, T1560.001, T1486, T1496.001, T1531, T1005, T1110] affected_products: ["Zimbra Collaboration"] cves: - id: CVE-2026-73570 cvss: "8.9" epss: 0.11736 type: rce vector: zero-click auth: pre-auth status: [exploited, cisa-kev, patch-available] affected: "Zimbra Collaboration before 10.1.20, where the optional zimbra-snmp package is installed and SNMP notifications are enabled" fixed: "10.1.20" sources: - url: "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories" publisher: "Zimbra (vendor security advisories)" date: "2026-08-13" role: primary - url: "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1041/" publisher: "CERT-FR (ANSSI)" date: "2026-08-19" role: corroborating - url: "https://euvd.enisa.europa.eu/vulnerability/CVE-2026-73570" publisher: "ENISA EU Vulnerability Database" date: "2026-08-13" role: corroborating - url: "https://thehackernews.com/2026/07/zimbra-patches-critical-snmp-command.html" publisher: "The Hacker News" date: "2026-07-21" role: corroborating - url: "https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/" publisher: "Microsoft Threat Intelligence" date: "2026-09-30" role: corroborating - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" publisher: "CISA Known Exploited Vulnerabilities catalog" date: "2026-08-21" role: corroborating - url: "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.20" publisher: "Zimbra (10.1.20 release notes)" date: "2026-07-20" role: corroborating - url: "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.21" publisher: "Zimbra (10.1.21 release notes)" date: "2026-09-24" role: corroborating - url: "https://security-hub.ncsc.admin.ch/#/posts/13022" publisher: "NCSC Switzerland, Cyber Security Hub" date: "2026-10-01" role: corroborating - url: "https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate" publisher: "ACN / CSIRT Italia (bulletin BL01/261005/CSIRT-ITA)" date: "2026-10-05" role: corroborating closed_sources: [] evidence: - quote: "ENISA indicates that vulnerability CVE-2026-73570 is being actively exploited. (translated from French)" original: "L'ENISA indique que la vulnérabilité CVE-2026-73570 est activement exploitée." publisher: "CERT-FR (ANSSI)" source_url: "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1041/" - quote: "Fixed a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled." publisher: "Zimbra (vendor security advisories)" - quote: "none of the identified vulnerabilities have been flagged as actively exploited" publisher: "The Hacker News" - quote: "Between July 28 and August 7, after a fix became available on July 20 but before public disclosure on August 13, Microsoft observed two distinct out-of-band scanning tools probing the vulnerable injection point." publisher: "Microsoft Threat Intelligence" source_url: "https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/" - quote: "Rotate all domain zimbraPreAuthKey values and review systemd units for unexpected ownership, enablement, or timestamp changes" publisher: "Microsoft Threat Intelligence" source_url: "https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/" - quote: "In two separate events, exploitation of CVE-2026-73570 culminated in the release of ransomware against the target servers. (translated from Italian)" original: "In due distinti eventi, lo sfruttamento della CVE-2026-73570 è culminato nel rilascio di ransomware a danno dei server bersaglio." publisher: "ACN / CSIRT Italia" source_url: "https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate" - quote: "No evidence emerged of successful intrusions against regularly updated instances. (translated from Italian)" original: "Non sono emerse evidenze di intrusioni riuscite a carico di istanze regolarmente aggiornate." publisher: "ACN / CSIRT Italia" source_url: "https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate" verification: multi-source sourcing_note: > Exploitation is confirmed first-hand by Microsoft Threat Intelligence, which investigated intrusions in more than one region and industry and names no actor, and CISA lists the flaw in KEV; ENISA's EU Vulnerability Database lists it in the EU KEV catalog from 2026-08-18 and CERT-FR relayed that. Zimbra's own advisory table carries no CVSS score for this CVE (its score column reads TBD), so the 8.9 comes from the ENISA record, which is cited directly, and the EPSS figure is FIRST's score for 2026-10-01. CSIRT Italia's account of ransomware, cryptomining and data theft comes from incidents it handled itself, and it says the evidence does not tie its two ransomware cases to one actor or payload. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 1 watchlist_hit: false actions: - "Upgrade every Zimbra Collaboration host to 10.1.21 (10.1.20 is the minimum for CVE-2026-73570); where the upgrade cannot happen at once, remove the zimbra-snmp package or disable SNMP notifications and restrict SNMP and SMTP to trusted hosts." - "On every host that ran a build before 10.1.20 with SNMP notifications enabled at any time since 2026-07-28, upgrading is not enough: rotate all domain zimbraPreAuthKey values and run the compromise check on every mailbox node, covering the zimbra user's crontab and /opt/zimbra/.ssh/authorized_keys, JSP or stray text files under /opt/zimbra/jetty_base/webapps/zimbra/public, droppers in /tmp and /var/tmp, and outbound connections from the mail server; where web shells or an LDAP dump turn up, rotate every mailbox and administrative credential." updates: - at: "2026-10-02T04:54:58Z" run_id: 2026-10-02T0404Z-intel type: update summary: > Microsoft Threat Intelligence published first-hand analysis of confirmed intrusions: probing of the injection point from 2026-07-28, before the 2026-08-13 disclosure, then web shells, root escalation, theft of Zimbra's authentication keys and cluster-wide movement, with the injection signature to hunt for. The 10.1.21 release, which also fixes unauthenticated password-recovery code prediction, and NCSC-CH's advisory of 2026-10-01 are added. CISA's KEV listing of 2026-08-21, not recorded before, is added; the 10.1.20 release date is corrected to 2026-07-20, the EPSS score is refreshed to 0.117 (FIRST, 2026-10-01), ENISA's 18 August date is its EU KEV listing, and the actions now ask for a compromise check as well as the upgrade. fields: [title, headline, summary, tags, techniques, cves, sources, evidence, sourcing_note, classification, actions, update_of, body] - at: "2026-10-06T05:00:00Z" run_id: 2026-10-06T0405Z-intel type: update summary: > CSIRT Italia's bulletin of 2026-10-05 reports compromises of exposed Zimbra servers through CVE-2026-73570 that ended in ELock-family ransomware, cryptomining, web shells with theft of the LDAP database and credential hashes, and a 48-hour mail outage for more than 6,000 mailboxes, and found no intrusion on regularly updated instances. Its host checks (the zimbra user's crontab and authorized_keys, JSP files in the Jetty public directory, droppers in temporary directories, egress) are added to the compromise check. fields: [summary, tags, entities, techniques, sources, evidence, sourcing_note, actions, body] migrated_from: null --- Zimbra's own security-advisory table records the fix for CVE-2026-73570 as "Fixed a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled", shipped in release 10.1.20 ([Zimbra, 2026-08-13](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)). That release went out on 20 July 2026 ([Zimbra, 2026-07-20](https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.20)) carrying nine fixes, and at the time none of them had been flagged as actively exploited; the vendor's stated position was that "in line with industry best practices, information disclosure is limited for security vulnerability fixes" ([The Hacker News, 2026-07-21](https://thehackernews.com/2026/07/zimbra-patches-critical-snmp-command.html)). The identifier arrived 24 days later, on 13 August, and the ENISA record describes the mechanism in full: because untrusted input is not properly sanitised during SNMP notification processing, "an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user" ([ENISA EU Vulnerability Database, 2026-08-13](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-73570)). ENISA scores it 8.9 with high attack complexity ([ENISA EU Vulnerability Database, 2026-08-13](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-73570)), and the flaw applies only to deployments where the optional zimbra-snmp package is installed and SNMP notifications are enabled. On 19 August CERT-FR issued its own advisory for the Zimbra bulletin and stated plainly that ENISA records CVE-2026-73570 as actively exploited ([CERT-FR, 2026-08-19](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1041/)). ENISA's record lists it in the EU KEV catalog from 18 August ([ENISA EU Vulnerability Database, 2026-08-13](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-73570)). What makes this worth an out-of-band look rather than a place in the next patch window is the sequence rather than the score: the code was fixed in July with no identifier attached, so an estate that drives its patching from CVE feeds, scanner signatures or an SBOM pipeline had nothing to match against for 24 days, and the flaw only became visible to those processes five days before it was recorded as exploited. Anyone who upgraded to 10.1.20 in July for unrelated reasons is already covered and does not know it; anyone who deferred is now unpatched against a flaw with a published exploitation status. **Exposure:** Zimbra Collaboration before 10.1.20 with the optional zimbra-snmp package installed and SNMP notifications enabled, which makes it a package check rather than a version check; CSIRT Italia also found compromises through older flaws on unsupported or unpatched lines ([ACN / CSIRT Italia, 2026-10-05](https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate)). **Detection:** The behaviour to look for follows from the mechanism. Command injection at the point where a notification is formatted means the observable is a command run from the notification path that carries more than the notification itself. In process-execution telemetry with parent lineage, a shell created by Perl running a generated swatchdog script is the baseline Microsoft's hunting logic starts from, and the signal is the injection signature inside that invocation: a legitimate snmptrap invocation immediately followed by shell metacharacters and a wget or curl call, wrapped in a trailing comment character that swallows the remaining legitimate arguments ([Microsoft Threat Intelligence, 2026-09-30](https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/)). On the network side, the wget or curl call in the injection signature shows up as an outbound connection from the mail server made by the zimbra account. CSIRT Italia adds host checks for a server already compromised: the zimbra user's crontab and /opt/zimbra/.ssh/authorized_keys, SNMP exploit scripts under /opt/zimbra/data/tmp, JSP files or stray text files in the Jetty public directory, droppers, miners and ransomware payloads in /tmp and /var/tmp ([ACN / CSIRT Italia, 2026-10-05](https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate)). **Triage:** the notification path itself legitimately runs a shell that invokes snmptrap, so a shell child of the swatchdog Perl script is not suspicious on its own; the discriminator is what the command line carries beyond the snmptrap invocation, namely shell metacharacters followed by a wget, curl or other non-snmptrap command ([Microsoft Threat Intelligence, 2026-09-30](https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/)). **Defender takeaway:** the check that scopes this is a package check, not a version check: a Zimbra estate without the optional zimbra-snmp package installed and SNMP notifications enabled is not exposed to this flaw regardless of build. For everyone else, 10.1.20 or later is the remediation and removing the package or disabling notifications is the control that works without a maintenance window. Because exploitation preceded the identifier, an upgrade does not show that a host is clean: the compromise check is the second half of the remediation, covering the web shells, sudo configuration, systemd units and Zimbra secrets Microsoft describes. A vendor fix that ships ahead of its identifier is also invisible to every CVE-keyed process an organisation runs, so "we patch what the scanner shows" leaves a gap exactly as long as the gap between the release and the CVE. ## Update — 2026-10-02T04:54:58Z Microsoft Threat Intelligence published first-hand analysis on 2026-09-30 of CVE-2026-73570 exploitation in more than one region and industry, naming no actor ([Microsoft Threat Intelligence, 2026-09-30](https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/)). It saw two out-of-band scanning tools probing the injection point between 2026-07-28 and 2026-08-07, after the fix and before the 2026-08-13 disclosure ([Microsoft Threat Intelligence, 2026-09-30](https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/)). CISA's KEV catalog lists the CVE, added 2026-08-21 ([CISA KEV, 2026-08-21](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)). After command execution as the zimbra account, Microsoft observed, across its cases and not necessarily on every host, JSP web shells written to publicly served directories after temporarily opening write permission, with copies on peer mailbox nodes, and reverse shells built from a named pipe and `openssl s_client`; a privilege escalation that used a symlinked log file to take ownership of the sudo PAM configuration, added a `pam_exec` hook and created a NOPASSWD sudoers entry for the zimbra account; a systemd unit named like a Zimbra logging component with timestamps matched to existing services; theft of Zimbra's service credentials with `zmlocalconfig -s`, followed by authenticated LDAP queries for the pre-authentication key, the auth-token key and the two-factor secret attribute; and SSH and rsync movement across the cluster with Zimbra's own SSH identity ([Microsoft Threat Intelligence, 2026-09-30](https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/)). Microsoft's remediation is to upgrade to 10.1.20 or later, remove the zimbra-snmp package or disable SNMP notifications and restrict SNMP and SMTP to trusted hosts, rotate all domain `zimbraPreAuthKey` values, review systemd units, and hunt for JSP files on every mailbox node ([Microsoft Threat Intelligence, 2026-09-30](https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/)). Zimbra's 10.1.21 release of 2026-09-24 also fixes unauthenticated prediction of password-recovery codes that could reset a user's password, WebDAV acceptance of pre-MFA tokens, and OnlyOffice-integration flaws including file write to remote code execution ([Zimbra, 2026-09-24](https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.21)); the table lists no CVE or score for the recovery-code and WebDAV fixes ([Zimbra, 2026-08-13](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)), and NCSC Switzerland published an advisory for the release on 2026-10-01 with exploitation status unknown ([NCSC Switzerland, 2026-10-01](https://security-hub.ncsc.admin.ch/#/posts/13022)). ## Update — 2026-10-06T05:00:00Z CSIRT Italia reports, in bulletin BL01/261005/CSIRT-ITA, multiple compromises of internet-exposed Zimbra servers handled in the Italian national context, mostly through CVE-2026-73570 and to a lesser extent through older flaws on unpatched or end-of-life instances ([ACN / CSIRT Italia, 2026-10-05](https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate)). In two CVE-2026-73570 cases exploitation ended in ransomware: on an 8.7.11 instance the attacker opened an interactive reverse shell and irreversibly encrypted many files on one node, and in a second case of unspecified version an ELock-family ransomware executable was dropped; both servers had the optional zimbra-snmp package, and the evidence does not tie the two cases to one actor or payload ([ACN / CSIRT Italia, 2026-10-05](https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate)). Three further cases installed cryptominers, one on 10.1.19 with a crontab entry for the zimbra user that ran a payload from a temporary directory ([ACN / CSIRT Italia, 2026-10-05](https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate)). In one case the exploit fetched a payload from external staging infrastructure and ran a Perl script directly in memory without writing files, with an attempted connection to a presumed IRC command-and-control server and no post-compromise activity found ([ACN / CSIRT Italia, 2026-10-05](https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate)). In two cases web shells were planted in the directories the web service exposes: on a 10.1.4 instance the attackers left JSP web shells, including ones managed with Behinder, and exfiltrated the LDAP database, the mailbox list and the credential hashes, and on another instance several JSP web shells took mail down for 48 hours for more than 6,000 mailboxes with no data theft documented ([ACN / CSIRT Italia, 2026-10-05](https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate)). The two cases share five command-and-control addresses and similar JSP constructs, but ACN says the evidence does not let it attribute both to the same actor ([ACN / CSIRT Italia, 2026-10-05](https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate)). ACN also describes a CentOS server turned into an SSH brute-force source after a write test in the Jetty public directory, with CVE-2026-73570 as the presumed but unconfirmed entry, and an end-of-life server whose mailbox passwords were all reset by the attacker through an undetermined vector ([ACN / CSIRT Italia, 2026-10-05](https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate)). Older flaws (CVE-2024-45519, CVE-2022-41352, CVE-2022-27925, CVE-2022-37042 and CVE-2023-38750) account for the remaining cases on unpatched or unsupported lines, including a further ransomware case on an 8.8.15 instance ([ACN / CSIRT Italia, 2026-10-05](https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate)). ACN says nearly all affected systems lacked applicable patches or ran unsupported branches, that in several cases the attackers persisted without root by staying in the zimbra application user's context, and that it found no evidence of successful intrusions on regularly updated instances ([ACN / CSIRT Italia, 2026-10-05](https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate)). Its mitigations are to update, to disable or remove the zimbra-snmp package where patching has to wait, to inspect the zimbra user's crontab and /opt/zimbra/.ssh/authorized_keys, to look for SNMP exploit scripts under /opt/zimbra/data/tmp and for JSP files or stray text files in the Jetty public directory, to check /tmp and /var/tmp for droppers, miners and ransomware payloads, to rotate all mailbox and administrative credentials where web shells or anomalies are found, to keep the administrative port TCP 7071 and unneeded SOAP interfaces off the public internet, and to filter egress from the Zimbra servers, including IRC and TCP 8801 ([ACN / CSIRT Italia, 2026-10-05](https://www.acn.gov.it/portale/w/zimbra-zcs-rilevato-sfruttamento-di-vulnerabilita-in-versioni-non-aggiornate)).