Threat reportVulnerabilityTL-2026-2082
Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injection
Hackers Target Zimbra Servers in Active Exploitation (TL-2026-2082) is a critical-severity software vulnerability scored CVSS 8.9, first published 2026-08-20 and last reviewed 2026-10-20. It has no confirmed attribution, affects Zimbra (Synacor) Zimbra Collaboration Suite (ZCS), references 1 CVE (CVE-2026-73570), maps to 43 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 75 indicators of compromise.
- CVSS
- 8.9/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 43MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 75Indicators of compromise
Key facts for TL-2026-2082
- Threat ID
- TL-2026-2082
- Severity
- CRITICAL
- CVSS
- 8.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, military, diplomatic, education, enterprise
- Target regions
- Europe, Asia, North America
- Detection rules
- 9
- Indicators of compromise
- 75
- Updates
- 2026-10-20 · 6 updates · revalidated 6× · latest source
Malware and tooling in Hackers Target Zimbra Servers in Active Exploitation
Malware and tooling: Zimbra
How Hackers Target Zimbra Servers in Active Exploitation works
An unauthenticated remote code execution vulnerability (CVE-2026-73570, CVSS 8.9) in Zimbra Collaboration Suite (ZCS) prior to version 10.1.20 is being actively exploited in the wild. The OS command injection flaw resides in the optional zimbra-snmp package when SNMP notifications are enabled (with swatchdog running, enabled by default), allowing attackers to execute arbitrary OS commands as the zimbra user via crafted SMTP requests. CERT Polska confirmed a live exploitation campaign on August 17, 2026, with ENISA following suit on August 18.
CVE-2026-73570 is a high-severity (CVSS 8.9) OS command injection vulnerability in Zimbra Collaboration Suite (ZCS) that enables unauthenticated remote code execution. The flaw exists in the optional zimbra-snmp package when SNMP trap notifications are enabled and the swatchdog service is running (swatchdog is enabled by default in Zimbra deployments). Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests to a vulnerable Zimbra server that, when processed through the SNMP notification subsystem, result in the execution of arbitrary operating system commands under the privileges of the zimbra user account. The vulnerability was fixed by Zimbra in version 10.1.20 ("Daffodil"), released on July 20, 2026, following a security advisory initially published on June 26, 2026.
CERT Polska issued advisory #145/2026 on August 17, 2026, warning that threat actors are actively exploiting CVE-2026-73570 in an ongoing campaign. ENISA confirmed exploitation in its KEV catalog on August 18, noting exploitation waves since the beginning of August. CERT-FR followed with advisory CERTFR-2026-AVI-1041 on August 19, and CCB Belgium issued an urgent warning the same day. Public reporting from SecurityWeek, BleepingComputer, and The Hacker News on August 20, 2026, brought the campaign to broader attention.
The Shadowserver Foundation tracked over 12,100 internet-exposed Zimbra servers, with the largest concentrations in Europe (4,382 servers) and Asia (4,492 servers), representing a substantial attack surface. The remaining servers were distributed across North America and other regions, though Shadowserver noted uncertainty about how many were honeypots or had already been patched.
Once attackers achieve command execution as the zimbra user, they can deploy web shells in Zimbra's Jetty web application directories (/opt/zimbra/jetty/webapps/ and /opt/zimbra/jetty_base/webapps/), drop staging files in /tmp/, access and exfiltrate email account data, harvest credentials from mailboxes and stored configurations, modify server-side settings, establish persistence mechanisms, and use the compromised mail server as a pivot point for lateral movement within the target network. The compromised Zimbra server runs email for the entire organization, making it a high-value target for credential theft, intelligence gathering, and further network penetration.
CERT Polska recommended specific IOC checks: inspect /var/log/zimbra.log for anomalous service status change entries containing attacker payloads, and audit files created by the zimbra user within the last 30 days under the Jetty webapps directories and /tmp/. No public proof-of-concept exploit code has been released, and no specific threat actor has been attributed to this campaign at the time of reporting. Zimbra vulnerabilities have historically been exploited by Russian state-sponsored groups (APT28, APT29, Winter Vivern, LAUNDRY BEAR) and Chinese state-sponsored actors, but the attribution for CVE-2026-73570 exploitation remains unknown.
MITRE ATT&CK techniques used in TL-2026-2082
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1556.003 Modify Authentication Process
Collection
T1005 Data from Local System; T1114 Email Collection; T1114.001 Email Collection; T1114.002 Email Collection; T1560 Archive Collected Data; T1560.001 Archive Collected Data
Lateral Movement
T1021 Remote Services; T1021.004 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Masquerading; T1070 Indicator Removal; T1070.006 Indicator Removal; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.002 Exfiltration Over Web Service
Discovery
T1046 Network Service Discovery; T1083 File and Directory Discovery; T1087 Account Discovery
Persistence
T1053.003 Scheduled Task/Job; T1098.004 Account Manipulation; T1505 Server Software Component; T1505.003 Server Software Component; T1543 Create or Modify System Process; T1543.002 Create or Modify System Process
Execution
T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1071.001 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Initial Access
T1190 Exploit Public-Facing Application
Impact
Privilege Escalation
T1548.003 Abuse Elevation Control Mechanism
Resource Development
Reconnaissance
Affected products and versions in Hackers Target Zimbra Servers in Active Exploitation
- Zimbra (Synacor) — Zimbra Collaboration Suite (ZCS)
Vulnerable versions: All versions prior to 10.1.20
Fixed in: 10.1.20 (Daffodil, released July 20, 2026)
Remediation for Hackers Target Zimbra Servers in Active Exploitation
Patches
- Upgrade to Zimbra Collaboration Suite version 10.1.20 (Daffodil) released July 20, 2026
Immediate actions
- Upgrade Zimbra Collaboration Suite to version 10.1.20 or later immediately
- Inspect /var/log/zimbra.log for anomalous service status change entries with injected payloads
- Audit /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ for files created by the zimbra user in the last 30 days
- Scan for unexpected JSP files, scripts, or executables in web application directories
- Rotate all email account credentials and administrator passwords if compromise is suspected
- Isolate any affected hosts and preserve forensic evidence
- Review mailbox access logs for unauthorized access patterns
Workarounds
- Disable SNMP notifications via the snmp_notify configuration parameter
- Remove the optional zimbra-snmp package entirely
- Restrict SMTP access to trusted networks only at the perimeter firewall
Longer-term hardening
- Disable or remove the zimbra-snmp package if SNMP monitoring is not strictly required
- Deploy endpoint detection and response (EDR) on mail servers with behavioral monitoring
- Implement network segmentation to isolate mail server from other critical systems
- Establish centralized log collection and alerting for Zimbra service anomalies
- Develop and test incident response playbook for Zimbra server compromise
- Subscribe to Zimbra Security Advisories for timely patch awareness
CVEs associated with Hackers Target Zimbra Servers in Active Exploitation
Weaknesses (CWE) in Hackers Target Zimbra Servers in Active Exploitation
Timeline of Hackers Target Zimbra Servers in Active Exploitation
- Zimbra initially discloses an SNMP command injection vulnerability in its security advisory, before a CVE is assigned
- Zimbra releases version 10.1.20 (Daffodil) fixing the SNMP command injection vulnerability along with 8 other security issues including multiple XSS flaws, CVE-2026-50055 (mail forwarding bypass), CVE-2026-50054 (mailbox delegation authorization), CVE-2026-10631 (EWS access control), and an SSRF in Nextcloud integration
- Microsoft begins observing pre-disclosure reconnaissance against Zimbra servers (curl/wget/ping/nslookup/id, ZB73570 User-Agent, OAST callbacks).
- ENISA reports exploitation waves beginning in early August 2026, approximately 10 days after the patch was released
- End of the pre-disclosure scanning window observed by Microsoft (2026-07-28 to 2026-08-07).
- CVE-2026-73570 is formally published in NVD with a CVSS 8.9 (HIGH) rating; GitHub Advisory Database updated with GHSA-jqh7-pchh-v74j
- CERT Polska issues advisory #145/2026 warning of an active exploitation campaign targeting CVE-2026-73570, providing specific IOC patterns and file paths for forensic analysis
- ENISA confirms the vulnerability as exploited in its KEV catalog (entry ID: c0bf679d-88c4-4a63-9674-a7bec42990c9), noting exploitation waves since early August 2026
- CERT-FR issues advisory CERTFR-2026-AVI-1041 confirming active exploitation; CCB Belgium issues urgent warning urging immediate patching of Zimbra servers
- Shadowserver Foundation identifies 155 compromised internet-facing Zimbra instances, the first confirmed-compromise count for this campaign.
- SecurityWeek, BleepingComputer, The Hacker News, and CybersecurityNews publish reports on the active exploitation campaign; Shadowserver reports 12,100+ exposed Zimbra servers online
- CISA adds CVE-2026-73570 to its Known Exploited Vulnerabilities (KEV) catalog, mandating remediation under Binding Operational Directive (BOD) 26-04 by 2026-08-24 (3-day deadline).
- Security Affairs publishes coverage of the CISA KEV catalog addition for CVE-2026-73570, the report that triggered this revalidation.
- Shadowserver scan data shows the compromised internet-facing ZCS instance count rising past 270.
- Deadline for U.S. federal civilian agencies to remediate CVE-2026-73570 per CISA BOD 26-04.
- Help Net Security reports 274+ confirmed-compromised instances against roughly 8,200 still-unpatched internet-facing ZCS servers; report that triggered this revalidation.
- Cloud Security Alliance research note states no named threat actor has been publicly attributed to the mass-exploitation campaign.
- Microsoft Security Blog publishes its analysis of the CVE-2026-73570 campaign: web shells, privilege escalation via zmmailboxdmgr/PAM, secret theft, zimdown2/zimclient2, and AzCopy exfiltration to Azure Blob Storage.
- GBHackers reports Microsoft Threat Intelligence analysis of post-exploitation: web shells, zimlog.service persistence, root escalation via PAM/sudo, and a Go credential-and-mailbox implant.
Update history for TL-2026-2082
- 2026-10-20 — Zimbra Collaboration Suite zimbra-snmp Command Injection (CVE-2026-73570) Exploited to Take Over Email Servers: What changed No field escalation. Exploitability (ACTIVE) and status (ACTIVE) already match. The report's severity of HIGH is lower than the existing CRITICAL, so it is ignored (no downgrades). New indicators (17) 3 additional C2 IPs (45.32
- 2026-10-01 — Zimbra Collaboration Suite SNMP Command Injection (CVE-2026-73570) Exploited to Gain Root Access and Steal Mailbox Authentication Secrets: What changed No whitelisted field escalation (severity CRITICAL, exploitability ACTIVE, status ACTIVE already set). Post-exploitation picture materially expanded: root escalation via PAM/sudo abuse, systemd/cron persistence, custom Go impla
- 2026-08-25 — CVE-2026-73570: Unauthenticated RCE in Zimbra SNMP Component Exploited to Breach 270+ Servers: What changed No change to severity_level, exploitability, status, cvss_score, or attribution fields -- all match the existing record. The report's compromise counts (274+, 8,200 unpatched), CISA KEV/BOD deadline, and CERT Polska guidance du
- 2026-08-25 — CVE-2026-73570: Zimbra Collaboration Suite SNMP Command Injection Actively Exploited, 274+ Instances Compromised: What changed No field escalation — severity (CRITICAL), exploitability (ACTIVE), and status (ACTIVE) were already at their ceiling. The material change is confirmed-compromise scale: Shadowserver counted 155 compromised instances on 2026-08
- 2026-08-22 — CISA Adds Zimbra Collaboration Suite (ZCS) SNMP Command Injection Flaw CVE-2026-73570 to KEV Catalog: What changed No escalation — severity remains CRITICAL, exploitability ACTIVE, status ACTIVE, CVSS 8.9, attribution LOW, matching the existing record. Report adds an EPSS score (0.54%, 43rd percentile), names NASK/Poland as CERT Polska's pa
- 2026-08-21 — CVE-2026-73570: OS Command Injection in Zimbra Collaboration Suite SNMP Notification Processing — Active Exploitation: What changed CISA added CVE-2026-73570 to its KEV catalog on 2026-08-21, mandating remediation under BOD 26-04 by 2026-08-24; severity escalated HIGH → CRITICAL reflecting the mandatory-remediation KEV listing and continued active exploitat
Sources cited for Hackers Target Zimbra Servers in Active Exploitation
- CERT Polska Advisory #145/2026 — Aktywnie wykorzystywana podatnosc w Zimbra Collaboration Suite
- ENISA KEV — CVE-2026-73570
- CERT-FR Advisory CERTFR-2026-AVI-1041
- SecurityWeek — Hackers Target Zimbra Servers in Active Exploitation Campaign
- BleepingComputer — Critical Zimbra RCE flaw now actively exploited in attacks
- The Hacker News — Attackers Exploit Zimbra SNMP Flaw for Unauthenticated RCE
- CybersecurityNews — Zimbra RCE Vulnerability Actively Exploited in the Wild
- SecurityOnline — Zimbra CVE-2026-73570 RCE Exploited in the Wild
- NVD — CVE-2026-73570 Detail
- GitHub Advisory — GHSA-jqh7-pchh-v74j
- Zimbra Releases — 10.1.20 (Daffodil) Patch Release
- Zimbra Security Advisories
- Zimbra Blog — Patch Release Update Zimbra 10.1.20
- CSO Online — Critical Zimbra security update fixes 9 vulnerabilities
- CISA Known Exploited Vulnerabilities Catalog
Detection coverage for TL-2026-2082
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2082 across Splunk SPL, Microsoft KQL and Sigma, covering 75 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.