Cybersecurity experts are warning organizations about a critical vulnerability in Zimbra mail servers that has been actively exploited by hackers. This flaw allows unauthorized command execution on affected servers, posing a serious threat to internet-facing systems. The issue, identified as CVE-2026-73570, involves a command-injection vulnerability in the server’s SNMP notification feature, which can be exploited without user interaction.
Details of the Exploit
This vulnerability primarily affects systems where the optional zimbra-snmp package is installed and SNMP notifications are enabled. Attackers can manipulate the way Zimbra handles specific SMTP requests, inserting malicious shell characters that trigger the SNMP notification handling process. This process then executes the malicious command as the zimbra service account, allowing attackers to gain control without needing any credentials.
Microsoft Threat Intelligence has been closely monitoring these attacks, which have impacted several organizations across various industries and regions. Their investigation revealed that attackers used a combination of automated payloads and manual interventions to infiltrate and manipulate vulnerable servers. This highlights the necessity for organizations to patch and secure their systems promptly.
Widespread Impact and Intrusion Techniques
The ramifications of these attacks extend well beyond individual mailboxes. Investigators discovered web shells, encrypted connections, and attempts to steal authentication materials. Attackers employed techniques such as altering web-directory permissions, deploying JSP web shells, and leveraging SSH identities to expand their access across server clusters.
Attackers focused on extracting service secrets and credentials, enabling them to compromise services like LDAP, MySQL, and Postfix. Additionally, they collected sensitive data such as pre-authentication keys and token-signing materials. These actions underscore the broader security risks posed by the exploit, emphasizing the need for comprehensive security audits and updates.
Mitigation and Future Outlook
To mitigate these risks, administrators are advised to upgrade to Zimbra version 10.1.20 or later. In situations where immediate updates are not feasible, disabling SNMP notifications and restricting access to trusted hosts are recommended interim measures. Organizations should also review and tighten their monitoring settings and investigate any unusual command activity.
The cybersecurity community emphasizes that reverse-shell alerts on internet-facing mail servers should be treated as critical incidents. Administrators should meticulously inspect server nodes for unexpected files, configuration changes, and suspicious activities. Proactive measures, such as rotating authentication keys and preserving logs, are crucial for containing potential breaches and preventing future intrusions.
As cyber threats continue to evolve, staying informed and vigilant remains a key component of effective cybersecurity strategies. Organizations are encouraged to integrate threat intelligence tools into their security operations centers (SOCs) to enhance incident response and reduce investigation times.
