CVE-2026-73570 command injection in Zimbra yields remote code execution
Original title: How CVE-2026-73570 turns a Zimbra log file into remote code execution
A malformed SMTP recipient is logged and run by Swatchdog as the zimbra user; fix is 10.1.20 or later.
Elastic reproduced unauthenticated command injection in Zimbra tracked as CVE-2026-73570 while building detections. A crafted SMTP recipient is written to /var/log/zimbra.log, matched by Swatchdog, and passed through Perl backticks to /bin/sh. Code runs as the zimbra user, which can read every mailbox and send as local identities. The flaw is patched as of version 10.1.20. Several public proofs of concept never match the log pattern, so a failed test can look like a patched server.
Unconfirmed: The article does not say whether attackers are exploiting CVE-2026-73570 outside lab tests.
- Elastic says one malformed recipient address is enough to trigger it.
- The tested build was Release 10.1.16.BETA.4200001.UBUNTU24.64.
- Postfix logs an unclosed RCPT TO address into /var/log/zimbra.log.
- Swatchdog invokes dosnmp only when SNMP notifications are enabled.
- A detection fires when a shell spawns anything other than snmptrap.
Impact: unauthenticated remote code execution as the zimbra user
| Product | Affected | Fixed in |
|---|---|---|
| Zimbra | before 10.1.20 | 10.1.20+ |
- 1.Upgrade Zimbra SMTP hosts to version 10.1.20 or later.
- CVEs
- CVE-2026-73570
- Vendors
- Zimbra
- Organizations
- Elastic Security Labs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73570 | Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite | 8.9 | 72% | KEVPoC ×5 | KEV |
From the original article
5 min read at elastic.co
We reproduced the Zimbra command injection vulnerability and found that several public PoCs write a payload Swatchdog never matches, so a failed test looks like a patched server.
By Eric Forte · elastic.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.