Affected Systems

Zimbra Collaboration Suite versions prior to 10.1.20, when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Internet-facing mail servers are at risk. Exploitation requires no authentication or user interaction.

Exploitation Status

Active exploitation confirmed. Microsoft Threat Intelligence observed attacks between July 28 and August 13, 2026, targeting multiple regions and industries. Attackers deployed JSP webshells, reverse shells, and persistent access tools. Pre-disclosure reconnaissance and scanning activity detected before public disclosure on August 13, 2026.

Business Impact

Attackers achieved full command execution as the zimbra service account, leading to webshell deployment, privilege escalation, email access, credential theft, and data exfiltration. Observed activity included both automated exploitation and hands-on-keyboard operations. Multiple organizations across sectors and geographies were compromised. Risk is limited to environments with the optional zimbra-snmp package installed and SNMP notifications enabled.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade all Zimbra Collaboration Suite instances to version 10.1.20 or later, released July 20, 2026.
  • If immediate patching is not possible, disable SNMP notifications or uninstall the zimbra-snmp package as a temporary mitigation.
  • Hunt for JSP webshells in Zimbra webroot directories, including /opt/zimbra/jetty/webapps/ and mailboxd servlet-work paths. Search for files with unusual timestamps or names.
  • Review SMTP logs, swatchdog logs, and snmptrap execution logs for suspicious shell metacharacters or out-of-band callback domains (oast[.]fun, oast[.]online, dnslog[.]pp[.]ua, requestrepo[.]com, bypass[.]eu[.]org).
  • Monitor for HTTP User-Agent string 'ZB73570', DNS queries to randomized subdomains, and outbound connections from the zimbra service account using curl, wget, or reverse shell patterns.
  • Audit zmprov command history and check for unauthorized SSH key additions or cron/systemd persistence mechanisms on Zimbra hosts.