Attackers Weaponize Zimbra Flaw to Plant Web Shells and Steal Auth Secrets

Microsoft Security Research has observed active exploitation of an already-patched flaw in Zimbra Collaboration Suite (ZCS). The bug, tracked as CVE-2026-73570 (CVSS 8.9), is an unauthenticated OS command injection flaw that leads to remote code execution. It only bites when SNMP notifications are enabled and the optional zimbra-snmp package is installed.

The attack can be triggered by a specially crafted SMTP request — an ordinary email to an exposed Zimbra server — with no authentication and no user interaction. Zimbra fixed the flaw in July 2026 with version 10.1.20.

What the attackers did

After successful exploitation, Microsoft saw JSP web shells and reverse shells deployed, privilege escalation, persistent remote-access tooling, and memory-backed execution. The intruders read email and collected authentication and mailbox data, then created archives and attempted to move them out. Who is behind the campaign remains unknown; affected organizations spanned more than one region and industry, though not every host showed every stage of the chain.

CERT Polska first flagged real-world exploitation in August 2026, urging admins to inspect "/var/log/zimbra.log" for suspicious service restarts. CISA later added the flaw to its Known Exploited Vulnerabilities catalog, ordering US federal agencies to patch by August 24. Microsoft's telemetry places the activity between the July 20 patch release and the August 13 public disclosure.

The attack chain

First, two distinct scanning tools probed the injection path to confirm command execution without dropping a payload. The attackers then ran commands as the "zimbra" service account, planted multiple web shells for redundancy, pulled payloads via wget or curl, and opened interactive reverse shells. Persistence relied on cron, systemd, and memfd_create; in some cases they briefly opened a public directory for writing and restored the permissions afterward to hide the change.

Rather than chasing individual passwords, they targeted centralized secrets: the "zmlocalconfig -s" command recovered keys later used in LDAP queries for high-value attributes like zimbraPreAuthKey, zimbraAuthTokenKey, and zimbraTwoFactorAuthSecret. Zimbra's own SSH identity enabled lateral movement across cluster nodes. One campaign used the Go-based Zimdown2 and Zimclient2 tools, offering interactive shells, file operations, and SOCKS5 proxying. On one server, the actor packed recent mailbox backups into an archive and tried to exfiltrate it via AzCopy to Azure Blob storage.

What to do

Microsoft urges immediate patching. Where that isn't possible, remove the zimbra-snmp package, disable SNMP notifications, and restrict SNMP and SMTP access to trusted hosts. As additional steps, rotate Zimbra authentication secrets and scan servers for leftover web shell persistence.

Source: The Hacker News