CVE-2026-73570: Zimbra SNMP — Unauthenticated RCE, Data Theft (September 2026)

CVE-2026-73570 — Zimbra Collaboration Suite SNMP

CVE-2026-73570 is a critical vulnerability in the SNMP notification path of Zimbra Collaboration Suite, enabling unauthenticated attackers to execute arbitrary OS commands as the zimbra service account. This flaw is under active exploitation in the wild, with attackers achieving persistent remote access and exfiltrating sensitive email data. CVSS score is critical; immediate remediation is mandatory.

Attack Vector

Attackers exploit the SNMP notification handler on internet-facing Zimbra servers, sending crafted requests that trigger OS command injection without authentication. Successful exploitation allows deployment of JSP webshells, reverse shells, and privilege escalation tools. Observed IOCs include the User-Agent string 'ZB73570' and outbound connections to collaborator domains such as oast.fun, oast.online, dnslog.pp.ua, requestrepo.com, and bypass.eu.org. These are used for command-and-control as well as data exfiltration. Attackers maintain persistence by installing webshells and hidden access paths across mail server clusters.

Who Is at Risk

All organizations running internet-exposed Zimbra Collaboration Suite servers are at immediate risk, regardless of sector or region. Multiple confirmed victims span various industries globally. Clusters with SNMP enabled and lacking the latest security updates are especially vulnerable. No authentication is required for exploitation, increasing risk for any unpatched, externally reachable instance.

Patch & Mitigate

• Patch: Apply the official Zimbra security update addressing CVE-2026-73570 as soon as possible. Check Zimbra advisories for exact patch version and release date.
• Workaround: If patching is not immediately possible, restrict SNMP access at the network perimeter and disable unnecessary SNMP services.
• Detect: Review logs for User-Agent 'ZB73570', unexpected outbound connections to listed collaborator domains, and the presence of unauthorized JSP files or reverse shell activity on mail servers.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit unauthenticated command injection to gain entry.
• TA0005 — Defense Evasion: Webshells and hidden access paths are deployed to maintain persistence and evade detection.
• TA0009 — Collection: Email authentication and mailbox data are accessed and exfiltrated post-compromise.

Source: https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/