CVE

CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Exploitation IoCs 6

Domain wsweb03[.]blob[.]core[.]windows[.]net

Filename final.tar.gz

Filename localconfig.xml

Filename zimbra_identity

Filename zimlog.service

GitHub Repo aka.ms/downloadazcopy-v10-linux

MITRE ATT&CK TTPs 12

T1003

OS Credential Dumping

Credential Access

T1021.001

Remote Desktop Protocol

Lateral Movement

T1021.006

Windows Remote Management

Unsecured Credentials

Source Articles

Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

Threat actors are exploiting a patched command injection vulnerability, CVE-2026-73570, in Zimbra Collaboration Suite (ZCS) to achieve remote code execution without authentication. The flaw is triggered via a crafted SMTP request when SNMP notifications are enabled and the zimbra-snmp package is installed. Upon exploitation, attackers deploy JSP web shells, establish reverse shells, escalate privileges, and harvest authentication secrets including LDAP credentials and service account data. They also perform lateral movement using Zimbra's SSH identity and exfiltrate mailbox data, sometimes using cloud tools like AzCopy targeting Azure Blob storage.

hacker-news Sep 30, 2026