Crafted emails give attackers shells on Zimbra servers running SNMP notifications
Microsoft says attackers are using CVE-2026-73570 to run commands on Zimbra mail servers with one crafted email and no login. Zimbra shipped the fix in 10.1.20 on July 20, 24 days before disclosure, so anyone who waited for the advisory to patch was already late.
The Watch · Security desk
What happened
- The attack works only against internet-facing Zimbra servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and no user has to open or click anything.
- Between July 28 and August 7, Microsoft watched two distinct scanning tools probe the injection point while the flaw was still undisclosed.
- After getting in, attackers deployed JSP web shells and reverse shells, escalated privileges, installed persistent remote-access tooling and ran payloads from memory.
- Attackers read email, collected authentication and mailbox data, packed it into archives and then transferred the archives.
- Microsoft found victim organizations in more than one region and more than one industry, with exploitation not confined to a single sector or geography.
Why it matters
- Who has to decide decision Zimbra servers that never installed zimbra-snmp, or run with SNMP notifications off, are outside this bug. Where 10.1.20 cannot go in at once, removing the package or disabling notifications takes away a condition the exploit needs.
- What it costs cost The upgrade leaves in place any web shell, cron job or systemd unit planted before it. Any server exposed before patching needs a sweep of webroots and schedulers on every mailbox node, including peers of the one first hit.
- What's now possible capability Successful probes called out from the mail server itself. Egress DNS and proxy logs showing that server contacting the listed callback domains, or sending a ZB73570 User-Agent, are evidence that commands ran there.
- Who's exposed exposure Taking authentication and mailbox data extends a server compromise to every user whose credentials and mail sat on it, so account resets and a mail-exposure review follow any confirmed hit.
Next story · Security · Sep 30
CISA warns a single unauthenticated request can root MikroTik RouterOS below 7.24Confirmed3 publishers
The first probes Microsoft logged came eight days after Zimbra shipped the fix and 16 days before the CVE went public [18][19]. Both scanning tools used the same swatchdog-to-snmptrap route that later appeared in confirmed compromises [6].
The flaw sits in Zimbra's SNMP notification processing [1]. A crafted SMTP request carries shell metacharacters into the notification data [16]. When a service-state change sets off health monitoring, swatchdog places that attacker-controlled value inside an snmptrap shell command [16]. Whatever it contains runs with the privileges of the zimbra service account [2].
Early probes were built to confirm execution without delivering a payload [15]. Some ran local identity checks or dropped a small fingerprint script that showed both command execution and outside access to the server's webroot [15]. Others used curl, wget, ping and nslookup to reach one-off subdomains on oast[.]fun, oast[.]online, dnslog[.]pp[.]ua and requestrepo[.]com, plus campaign infrastructure under bypass[.]eu[.]org [14]. HTTP callbacks carried a ZB73570 User-Agent. DNS and ICMP callbacks used randomized subdomains [22].
In confirmed intrusions, attackers planted JSP web shells by changing webroot permissions, rebuilding an encoded, compressed payload from staged fragments, writing it into publicly reachable application directories and deleting the fragments [11]. Shells went onto both Jetty and mailboxd paths, with extra copies on peer mailbox nodes [13]. Other chains used cron, systemd or memfd_create for recurring or memory-backed execution [12].
Two distinct scanning tools, campaign infrastructure and automated payload delivery running beside hands-on-keyboard sessions describe an organized, repeated operation [6][14][8]. Microsoft's attack-chain diagram merges behavior from several confirmed compromises. No single host necessarily showed every stage [17].
What to watch
- A public proof of concept for CVE-2026-73570 would put the injection path within reach of operators beyond the two scanning tools Microsoft tracked.
- Attribution of the activity to a named group would show whether one crew or several are working the same bug.
- A count of affected organizations from Microsoft would size a campaign currently described only as spanning more than one region and industry.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence80
- Adoption40
- Hype gap+5
- Incentives
- Not scored
- Confidence75
Perspective Coverage
4 publishers- Builder
- Builder 21%
- Operator
- Operator 68%
- Investor
- Investor 11%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path.
- [2]
Embedded shell commands execute with the privileges of the zimbra service account.
- [3]
Exploitation can be triggered by a specially crafted email against internet-facing Zimbra servers when the optional zimbra-snmp package is installed and SNMP notifications are enabled, without requiring authentication or user interaction.
- [4]
Zimbra version 10.1.20, released July 20, 2026, contains the remediation for CVE-2026-73570.
- [5]
CVE-2026-73570 was publicly disclosed on August 13, 2026.
- [6]
Between July 28 and August 7, Microsoft observed two distinct out-of-band scanning tools probing the vulnerable injection point, using the same swatchdog-to-snmptrap execution path later observed during exploitation.
- [7]
Observed post-exploitation activity included deployment of JSP web shells and reverse shells, privilege escalation, persistent remote-access tooling and memory-backed execution.
- [8]
The activity included both automated payload delivery and hands-on-keyboard operations on compromised mail servers.
- [9]
Threat actors accessed email and collected authentication and mailbox data, with archive creation and subsequent transfer activity observed.
- [10]
Microsoft observed affected organizations in more than one region and industry; exploitation was not limited to a single sector or geographic area.
- [11]
Attackers deployed JSP web shells by changing webroot permissions, reconstructing an encoded and compressed payload from staged fragments, and writing the decoded payload to publicly accessible application directories; the staging fragments were then removed, leaving the web shell available for HTTP-based access.
- [12]
Other execution chains used cron, systemd, or memfd_create to maintain recurring or memory-backed execution.
- [13]
Multiple JSP web shells were deployed across Jetty and mailboxd application paths, including additional copies on peer mailbox nodes.
- [14]
Operators validated command execution with out-of-band probes to unique subdomains on oast[.]fun, oast[.]online, dnslog[.]pp[.]ua, requestrepo[.]com and campaign-associated infrastructure under bypass[.]eu[.]org, using commands such as curl, wget, ping, nslookup and id.
- [15]
The probes were designed to confirm execution without delivering a payload, by performing local identity checks or dropping a small system fingerprint script, demonstrating command execution and external access to the server's webroot.
- [16]
A crafted SMTP request containing shell metacharacters reaches Zimbra's SNMP notification processing; when a service-state change triggers health monitoring, swatchdog incorporates the attacker-controlled value into a snmptrap shell invocation, enabling command execution.
- [17]
Microsoft's attack-chain diagram combines behaviors observed across multiple confirmed compromises; no single host necessarily exhibited every stage.
- [18]
Probing of the injection point began 8 days after the fix was released.
- [19]
Probing of the injection point began 16 days before public disclosure.
- [20]
The fix was available 24 days before the flaw was publicly disclosed.
- [21]
Zimbra servers without the zimbra-snmp package installed, or with SNMP notifications disabled, lack a condition the exploit requires and are not reachable through this injection path.
- [22]
HTTP probe requests used the CVE-specific ZB73570 User-Agent, while DNS and ICMP requests used randomized callback subdomains.
- [23]
Upgrading to 10.1.20 closes the injection path but does not by itself remove web shells, cron or systemd persistence, or peer-node copies planted before the upgrade.
- [24]
Because probe commands ran on the targeted server, a successful probe produces outbound HTTP, DNS or ICMP traffic from the mail server to the callback domains, with the ZB73570 User-Agent on HTTP requests.
Sources
4 independent publishers whose own reporting we read for this story.
- arstechnica.comAttackers have been exploiting critical Zimbra flaw to steal emails
1 article · September 30, 2026
- microsoft.comUnauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
2 articles · September 30, 2026
- securityweek.comZimbra Vulnerability Exploited in the Wild Prior to Public Disclosure
1 article · October 1, 2026
- thehackernews.comAttackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
1 article · September 30, 2026
Topics and entities
Topics
- Email and collaboration server security
- Web Shells
- Command Injection
- Exploitation before disclosure