Zimbra CVE-2026-73570 Exploited: 274 Servers Compromised via SNMP Command Injection

The attack exploits a command injection flaw in Zimbra's SNMP notification subsystem. No credentials are required at any step, and the attack surface is the SMTP port (25) that every internet-facing mail server must expose by design.

Zimbra's zimbra-snmp package includes swatchdog, a daemon that monitors Zimbra service states and generates SNMP trap notifications when services change state. When a service status event occurs, swatchdog constructs a notification string by incorporating service name data and status descriptors. On ZCS versions before 10.1.20, these notification strings include user-controlled content from incoming SMTP connections without sanitization. An attacker sends a crafted SMTP request containing shell metacharacters (semicolons, pipe operators, backtick sequences, or dollar-sign command substitution patterns) embedded in fields that feed the notification string. Swatchdog passes the unsanitized string directly to a shell interpreter and the injected commands execute as the zimbra OS user.

The zimbra user has write access to the Jetty web application directories serving Zimbra's web interface: /opt/zimbra/jetty/webapps/ and /opt/zimbra/jetty_base/webapps/. Attackers deploy JSP webshells to these directories as the first post-exploitation step, establishing HTTP-accessible backdoors that survive server reboots and process restarts. The zimbra account also has read access to every stored message on the server, the Zimbra LDAP configuration database, and authentication credentials in the ZCS admin console. A successful CVE-2026-73570 exploit gives an attacker direct access to an organization's entire email archive and the keys to its mail server administration.

The attack does not require the victim organization to open an email, visit a URL, or take any action. A single malformed SMTP connection from any internet address to port 25 is sufficient to achieve OS command execution.

Two hundred seventy-four Zimbra servers were confirmed compromised as of August 22, 2026, with automated exploitation tooling driving the count from 155 to 274 in 48 hours following CERT Polska's public alert.

Shadowserver Foundation scans reveal the geographic spread: the United States leads with 46 infected instances, followed by Sweden (21), France (20), Germany (17), and 13 additional countries. The distribution reflects where organizations running self-hosted Zimbra are concentrated rather than deliberate geographic targeting. Government agencies, universities, and mid-market enterprises that chose Zimbra specifically to keep email infrastructure on-premises form the principal victim categories. These organizations accepted operational complexity to avoid cloud provider dependencies, and that same complexity now translates to slower patch cycles under active attack pressure.

At least 8,200 ZCS instances remain unpatched and internet-exposed per Shadowserver scan data. The actual vulnerable population is a subset, since the zimbra-snmp package is optional and SNMP notifications must be enabled. However, SNMP monitoring is standard practice in enterprise IT operations, and organizations using Nagios, PRTG, SolarWinds, or Zabbix to monitor Zimbra health are the population most likely to have the non-default configuration that enables this attack.

The exploitation growth curve matches the pattern seen in JetBrains TeamCity CVE-2026-63077 earlier this month: slow automated scanning in the weeks after patch release, then rapid acceleration once exploit kits incorporate the vulnerability. In both cases, organizations without five-week patch cycles faced active attacks with no warning. The Shadowserver Foundation data captures confirmed exploitation artifacts, not just scanning activity.

Synacor released the patch for CVE-2026-73570 on July 20, 2026. Confirmed in-the-wild exploitation appeared five weeks later. That gap is shorter than the 60-day patching cycle common at many organizations and shorter than the window many defenders need to schedule and complete a major application upgrade.

The timeline shows how quickly defenders must move once a CVE with a mature exploit exists for a critical service:

• June 26, 2026: Vulnerability initially disclosed; temporary mitigation guidance published while Synacor finalized the patch.
• July 20, 2026: Synacor released Zimbra Collaboration Suite 10.1.20 with the fix for CVE-2026-73570.
• August 17, 2026: CERT Polska identified and publicly documented active in-the-wild exploitation, the first public confirmation that attackers had weaponized the vulnerability.
• August 20, 2026: Shadowserver Foundation scans detected 155 confirmed compromised Zimbra instances.
• August 21, 2026: CISA added CVE-2026-73570 to the Known Exploited Vulnerabilities catalog and ordered FCEB agencies to remediate by August 24, a three-day deadline.
• August 22, 2026: Confirmed compromised instance count reached 274.
• August 24, 2026: Federal remediation deadline elapsed; exploitation continues against unpatched private-sector organizations.

Zimbra has attracted nation-state actors in prior campaigns. APT28 and APT29 exploited earlier Zimbra vulnerabilities including CVE-2022-27925 and CVE-2024-45519 to steal government email data. The current CVE-2026-73570 campaign shows automated opportunistic tooling rather than targeted APT tradecraft. Initial footholds from opportunistic exploitation are frequently sold to higher-sophistication actors, particularly in government and critical infrastructure sectors. Organizations in those sectors should treat any confirmed CVE-2026-73570 compromise as a potential intelligence exposure, not only a malware incident.

The broader August 2026 patching context, including the DNS-wormable CVSS 9.8 Windows flaw addressed this month, is covered in the August 2026 Patch Tuesday coverage on Decryption Digest.

No specific attacker-controlled C2 IP addresses, domains, or malware file hashes have been publicly documented for CVE-2026-73570 as of August 26, 2026. Detection relies on log analysis, filesystem inspection, and process behavior monitoring.

Log-based detection in /var/log/zimbra.log: Search for "Service status change" entries containing shell metacharacters: semicolons, pipe operators, backtick characters, or dollar-sign command substitution patterns. Also flag entries containing embedded URLs, raw IP addresses, or base64-encoded strings in positions where only a Zimbra service name should appear. These patterns indicate the SNMP notification handler processed unsanitized attacker input.

Filesystem inspection: Run this command on every ZCS server to surface files created in key directories after July 20, 2026, the patch release date: find /opt/zimbra/jetty/webapps /opt/zimbra/jetty_base/webapps /tmp -newer /opt/zimbra/bin/zmlocalconfig -user zimbra -type f 2>/dev/null

Review every file this command returns. Any JSP, JSPX, shell script, Python file, or binary not part of the standard ZCS package warrants immediate investigation as a webshell or dropped payload.

Process monitoring: Flag any instance of bash, sh, dash, python, perl, curl, or wget that has swatchdog, zmsnmpinject, or a Zimbra SNMP process as a parent. This process lineage does not occur in a healthy ZCS deployment.

Outbound network anomalies: Alert on outbound connections from the zimbra user process to external IP addresses outside the organization's known mail relay pool and SNMP trap destinations.

No CVE-specific community Sigma rule exists for CVE-2026-73570 yet. These rules were generated by Decryption Digest from the vulnerability's known behavior. Validate against your environment before production deployment. Both rules carry status: experimental.

Rule 1 targets Linux process creation telemetry for shell processes or download utilities spawned from Zimbra SNMP handler processes (swatchdog, zmsnmpinject). The SNMP daemon has no legitimate reason to spawn interactive shells or network utilities in a healthy ZCS deployment. This rule should fire very rarely in normal operations and demands immediate investigation every time it fires. Deploy in your SIEM's Linux endpoint process telemetry pipeline.

Rule 2 targets Linux file event telemetry for new JSP, JSPX, or shell script files created in Zimbra Jetty webapps directories. Webshell deployment in /opt/zimbra/jetty/webapps/ or /opt/zimbra/jetty_base/webapps/ is the dominant post-exploitation persistence mechanism following CVE-2026-73570. Tune the filter to exclude files written during the ZCS upgrade process. Set this rule to page on-call immediately.

The WAF rules below target the post-exploitation HTTP phase of CVE-2026-73570. The initial attack arrives via SMTP port 25 and cannot be blocked by an HTTP WAF. Once attackers deploy a JSP webshell in the Zimbra Jetty directory, they access it through the Zimbra web interface URL. The WAF rules detect anomalous HTTP requests to Zimbra webapp paths that match known webshell access patterns. Deploy in count/log mode first to baseline normal Zimbra webapp traffic before switching to block mode.

Patching to ZCS 10.1.20 resolves the command injection flaw in the SNMP notification handler. If an immediate upgrade is not possible, disabling the zimbra-snmp package or SNMP notifications eliminates the vulnerable code path. Check every ZCS server for compromise indicators before concluding systems are clean.

Zimbra CVE-2026-73570 SNMP command injection is the most urgent patching priority for organizations running self-hosted Zimbra email infrastructure. A single crafted SMTP connection gives an unauthenticated attacker OS command execution, access to every inbox on the server, and the ability to deploy persistent webshells. Two hundred seventy-four servers are confirmed compromised. The CISA-mandated federal deadline has already elapsed. Private-sector organizations are the remaining unprotected population.

The risk extends beyond operations. Zimbra servers hold the complete communication history of an organization. A compromised mail server exposes every email sent or received, including legal communications, financial disclosures, and personnel records, to attacker collection. For government agencies and regulated industries, that data exposure carries legal and compliance consequences beyond the immediate incident response cost.

Patch to ZCS 10.1.20 before end of day. If patching today is not possible, disable zimbra-snmp immediately and schedule the upgrade for tomorrow. Inspect every ZCS server using the filesystem and log commands in the remediation section above. Any server running ZCS 10.1.19 or earlier with zimbra-snmp enabled should be treated as potentially compromised until verified otherwise.