ZCS Command Injection via SNMP Handlers Enables Unauthenticated Remote Code Execution

A critical remote command execution vulnerability affecting the Zimbra Collaboration Suite mail platform has come under active, widespread exploitation, allowing adversaries to harvest complete mailbox archives and persistent authentication credentials without prior system access.

The defect, tracked as CVE-2026-73570, carries a CVSS score of 8.9 and stems from improper input sanitisation inside the platform's SNMP notification subsystem. When paired with public-facing mail transfer agents, the pipeline permits unauthenticated remote attackers to inject arbitrary operating system commands that execute under the context of the underlying Zimbra operating system user account.

Maintainer Synacor initially addressed the vulnerability quietly in Zimbra Collaboration Suite version 10.1.20 on July 20, 2026, but delayed public disclosure until August 13, 2026. During this multi-week disclosure lag, adversaries reverse-engineered the binary changes and launched scanning campaigns against public instances. Telemetry captured by Microsoft and Polish national cybersecurity agency CERT Polska confirmed that threat groups actively probed enterprise mail infrastructure throughout late July and August, deploying backdoors before most operations teams recognised the severity of the patch.

At the protocol level, the flaw sits within the path where Postfix and upstream mail services hand off operational status alerts to the internal Simple Network Management Protocol daemon. Zimbra installs an optional telemetry service package, designated as zimbra-snmp, which runs the swatchdog log monitoring utility to scan log lines and dispatch snmptrap alerts. When inbound SMTP transactions parse user-controlled header parameters, specifically crafted envelope fields are logged directly into local syslog targets without shell argument sanitisation.

The swatchdog daemon watches these logs using regular expression pattern rules. Once matched, it interpolates the captured text variables into an unquoted string passed directly to a system shell execution call. Because characters such as semicolons, backticks, and pipes remain intact through the log parsing process, the external caller can append commands directly into the operating system trap execution string.

Image Source: Microsoft Blog Post

Observed exploitation begins with lightweight recon sweeps, where threat actors dispatch SMTP packets carrying shell logic designed to invoke out-of-band network calls via curl or nslookup. These callbacks confirm command execution before heavier payloads arrive. Once verification succeeds, attackers inject base64-encoded strings that write JSP web shells directly into web-accessible server directories, such as the Jetty application server root (/opt/zimbra/jetty/webapps/zimbra/).

With arbitrary file write and execution established within the Jetty container, operators execute zmprov command-line utilities natively available to the zimbra Unix user. This yields administrative LDAP tokens, authentication keys, and database credentials, unlocking access to export full user mailboxes into encrypted staging archives before exfiltration to external cloud buckets.

POST /zimbra/public/jsp_shell.jsp HTTP/1.1
Host: mail.target-enterprise.com
Content-Type: application/x-www-form-urlencoded
cmd=zmprov+getAllAccounts+-v+domain.com
zmmailbox -z -m user@domain.com getRestURL "//?fmt=tgz" > /tmp/backup.tgz

Remediating CVE-2026-73570 requires updating nodes to Zimbra version 10.1.20 or newer, which replaces shell-concatenated string execution within the monitoring subsystem with direct parameter arrays passed safely to system execve routines. For organizations unable to perform an immediate binary migration across multi-node clusters, maintainers recommend disabling the SNMP service package entirely to eliminate the vulnerable swatchdog loop.

su - zimbra
zmcontrol stop snmp
zmprov ms `zmhostname` -zimbraServiceEnabled snmp

Disabling SNMP halts outbound telemetry and automated performance trapping, which degrades central monitoring pipelines and cluster observability dashboards. However, operational intelligence from the Shadowserver Foundation indicates that approximately 274 compromised production instances were observed following disclosure, while roughly 10,000 public-facing Zimbra deployments remain exposed to scanning scripts. Systems teams running exposed mail gateways must treat unpatched servers as compromised, review Jetty deployment directories for unauthorized JSP files, rotate all LDAP and zimbra service account credentials, and restrict administrative endpoints to internal jump hosts.