Affected Systems
Zimbra Collaboration Suite (ZCS) versions prior to 10.1.20. Exploitation requires SNMP notifications enabled and the optional zimbra-snmp package installed. Unauthenticated remote code execution via crafted SMTP requests.
Exploitation Status
Active exploitation confirmed. Microsoft observed attacks between July 28 and August 13, 2026, targeting organizations across multiple regions and industries. CISA added CVE-2026-73570 to KEV catalog in August 2026. Attackers deployed JSP web shells, reverse shells, and custom Go-based tooling (Zimdown2, Zimclient2).
Business Impact
Attackers gain full remote code execution without authentication, deploy persistent web shells and remote-access agents, escalate privileges to unrestricted sudo, harvest Zimbra service credentials and authentication secrets (zimbraPreAuthKey, zimbraAuthTokenKey, zimbraTwoFactorAuthSecret), access mailbox data and backups, and exfiltrate database contents including user credentials and email metadata. Lateral movement across Zimbra clusters via SSH identity abuse. High risk for email compromise, credential theft, and persistent access to mail infrastructure.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade Zimbra Collaboration Suite to version 10.1.20 or later released in July 2026
- Review /var/log/zimbra.log for suspicious service restarts and check /tmp and Zimbra webapps directories for unauthorized JSP files created between July 28 and August 13, 2026
- Audit /etc/pam.d/sudo for unauthorized modifications granting passwordless sudo to zimbra service account and inspect systemd services for zimlog.service or similar persistence mechanisms
- Rotate all Zimbra service credentials, especially zimbraPreAuthKey, zimbraAuthTokenKey, and zimbraTwoFactorAuthSecret using zmlocalconfig commands
- Monitor outbound connections from Zimbra servers for OpenSSL-encrypted reverse shells, WebSocket, TLS, or raw TCP traffic to unknown external IPs, and review SSH authorized_keys and cron jobs for unauthorized entries