Attackers exploit Zimbra zero-click flaw CVE-2026-73570 on email servers
Original title: Hackers Exploit Zimbra Zero-Click Flaw to Take Control of Email Servers
Microsoft says crafted mail runs commands when SNMP notifications are on, then webshells and mailbox staging follow; fix is 10.1.20.
Microsoft Threat Intelligence says attackers are exploiting CVE-2026-73570, a command-injection flaw in Zimbra Collaboration Suite, on internet-facing mail servers with no user interaction. A crafted message can run commands as the Zimbra service account when the optional zimbra-snmp package and SNMP notifications are enabled. Zimbra shipped a fix in 10.1.20 on July 20, 2026, before public disclosure on August 13. Microsoft saw probing of the injection path from July 28 to August 7.
Unconfirmed: Microsoft says individual hosts may not show every stage of the documented chain, and the Azure transfer was unsuccessful.
- Post-exploit activity included JSP webshells, reverse shells, and a systemd unit named zimlog.service.
- Attackers sought zimbraPreAuthKey, zimbraAuthTokenKey, and zimbraTwoFactorAuthSecret.
- On one server, mailbox backups were archived and an AzCopy transfer to Azure Blob failed.
- If patching is delayed, remove zimbra-snmp and turn off SNMP notifications.
Impact: Command execution as the Zimbra account, then webshells and mailbox theft
| Product | Affected | Fixed in |
|---|---|---|
| Zimbra Collaboration Suite | — | 10.1.20 |
- 1.Upgrade to Zimbra 10.1.20 or later.
- 2.If patching is not immediate, remove zimbra-snmp and disable SNMP notifications.
- 3.Rotate Zimbra authentication secrets and look for JSP webshells, unexpected systemd units, and sudo changes.
- CVEs
- CVE-2026-73570
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting InterpreterT1505.003 Web ShellT1543.002 Systemd ServiceT1567.002 Exfiltration to Cloud Storage
- Vendors
- Zimbra
- Products
- Zimbra Collaboration Suite
- Organizations
- Microsoft Threat Intelligence
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73570 | Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite | 8.9 | 72% | KEVPoC ×5 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | psk1zim.abrdns.com | -DNS domain Dropper C2, serving agent.sh/agent2.sh/zimdown2 psk1zim[.]abrdns[.]com/agentws Dynamic-DNS domain zimclient2 WebSocket (port 8 |
| domain | tls.psk1zim.abrdns.com | cket (port 80, /agentws) and raw TCP (8080) command channel tls[.]psk1zim[.]abrdns[.]com Domain (C2) zimclient2 TLS command channel (port 443) |
| domain | transzimbra.linkpc.net | serving the build_amd64 cryptominer staged as .kworker_sys transzimbra[.]linkpc[.]net Dynamic-DNS domain Dropper C2, serving agent.sh/agent2. |
| domain | wslogzimbra.linkpc.net | .]com Domain (C2) zimclient2 TLS command channel (port 443) wslogzimbra[.]linkpc[.]net/wsstat WebSocket URL zimdown2 installer status reportin |
| ipv4 | 117.107.25.243 | cators of compromise Network indicators Indicator Type Role 117.107.25[.]243:7071 IPv4 (C2) Dropper C2, serving de.sh 192.255.193[.]11 |
| ipv4 | 192.255.193.111 | e 117.107.25[.]243:7071 IPv4 (C2) Dropper C2, serving de.sh 192.255.193[.]111:9004 IPv4 (C2) Miner C2, serving the build_amd64 cryptomi |
| ipv4 | 193.42.40.135 | P, different port; interactive session + mail-store staging 193.42.40[.]135:443 IPv4:port (C2) Organization-wide reverse-shell/recon |
| ipv4 | 3.209.137.175 | 3 IPv4:port (C2) Organization-wide reverse-shell/recon wave 3.209.137[.]175:443 IPv4:port (C2) Secondary C2, rotated-infrastructure e |
| ipv4 | 45.32.30.235 | dropper; confirmed executed on one host, retried elsewhere 45.32.30[.]235:8081 IPv4:port (C2) Reverse shell; earliest confirmed C2 |
| sha256 | 22ef852f6ebc39ee71235b90648b4b200b385c47d25c79545986493f8c70db69 | C435 SHA-256 ‘Looptik’ hacktool (GitHub-hosted LPE toolkit) 22EF852F6EBC39EE71235B90648B4B200B385C47D25C79545986493F8C70DB69 SHA-256 Loader staged as ‘systemd-resolved’; installs /usr/ |
| sha256 | 518fe65dd349180191d9b258ab24876aaed6613cd657d0b626d1fc24e03a22b6 | stalls /usr/sbin/_chronyd and decodes the in-memory stage 2 518FE65DD349180191D9B258AB24876AAED6613CD657D0B626D1FC24E03A22B6 SHA-256 Decoded in-memory stage 2; Base-chain command agent |
| sha256 | 65a7576c389326b6cdf9c993d0be6e5d50fed9655d1cdf2a3a50f2c21c8ec435 | 3361c2d3515537fb7ac8da6b9061b9a3f330e159 SHA-256 Zimclient2 65A7576C389326B6CDF9C993D0BE6E5D50FED9655D1CDF2A3A50F2C21C8EC435 SHA-256 ‘Looptik’ hacktool (GitHub-hosted LPE toolkit) 22EF |
| sha256 | 6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244 | 4f2ad0291c392c0a43dabff664c563618bd036d SHA-256 build_amd64 6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244 SHA-256 agent2.sh bf28f38122bf20d5fac969cc414daa6a890cdea87 |
| sha256 | aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d | afd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a SHA-256 de.sh aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d SHA-256 build_amd64 6ab7de2509038edf580aef6229c1c3db17f4da8 |
| sha256 | b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159 | cc414daa6a890cdea872d389ca93d2092b6b7773cf SHA-256 zimdown2 b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159 SHA-256 Zimclient2 65A7576C389326B6CDF9C993D0BE6E5D50FED965 |
| sha256 | bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf | 229c1c3db17f4da8f2d7d940818faf617d1938244 SHA-256 agent2.sh bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf SHA-256 zimdown2 b594a42b8f1c6f090327bb9a3361c2d3515537fb7a |
| sha256 | dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a | lic RPC providers File hashes (SHA-256) Indicator Type Role dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a SHA-256 de.sh aea991f694911e321b0ab97534f2ad0291c392c0a43da |
From the original article
4 min read at gbhackers.com
Hackers are exploiting a command injection vulnerability (CVE-2026-73570) in the Zimbra Collaboration Suite. This vulnerability allows attackers to compromise internet-facing email servers without any user interaction.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.