A security team at Microsoft spent the last week of September tracking something unusual: the same JSP web shell, written to the same folder path, on Zimbra mail servers scattered across different industries and regions with no obvious connection between the victims. The common thread wasn’t a phishing email or a stolen password. It was a single unauthenticated command-injection flaw, tracked as CVE-2026-73570, sitting in a feature most Zimbra admins never touch: SNMP notifications.
Table of Contents
What Is the Zimbra CVE-2026-73570 Flaw?
The flaw lives in Zimbra Collaboration Suite’s handling of SNMP notifications, but only when the optional zimbra-snmp package is installed and SNMP alerting is turned on. Attackers send a specially crafted SMTP request at the exposed mail server. If the server passes certain fields through to an SNMP trap without properly sanitizing them, the attacker’s shell commands execute with the privileges of the Zimbra service account, no login required. The vulnerability carries a CVSS score of 8.9, and CISA has since added it to its Known Exploited Vulnerabilities catalog, the government’s official list of flaws it has confirmed are being actively used in real attacks, not just theoretically exploitable ones.
Once inside, attackers aren’t just reading email. Microsoft’s writeup describes them writing JSP web shells directly into the Jetty and mailboxd application paths that Zimbra runs on, giving them a persistent, browser-accessible backdoor that survives a server reboot. From there they pull three specific secrets out of Zimbra’s configuration: zimbraPreAuthKey, zimbraAuthTokenKey, and zimbraTwoFactorAuthSecret. Anyone who knows what those three values are for can see why they’re valuable: those three attributes are tied to pre-authenticated logins, authentication tokens, and two-factor secrets, which is why stealing them is far more dangerous than stealing one password. The reporting doesn’t spell out exactly how the attackers used them, so the safe assumption is that all three need to be rotated.
How attackers expand access across a network
What separates this campaign from a typical opportunistic scan is the amount of follow-up effort involved. Microsoft observed attackers setting up systemd services and cron jobs to survive reboots, using SSH authorized keys for direct access, and using rsync to copy their web shells between different nodes of the same Zimbra cluster, meaning a single compromised mailbox server could become a foothold across an entire multi-node mail deployment. Two custom remote-access tools, referred to as Zimdown2 and Zimclient2, gave them WebSocket, TLS, and raw TCP channels back into the environment.
On the exfiltration side, the toolkit pulled entire MySQL databases and mailbox backups and, in at least some cases, pushed the stolen data out to Azure Blob Storage, a legitimate cloud service that blends in with normal outbound traffic far better than a server the attackers control directly.
Why small, self-managed mail servers are vulnerable
Large enterprises running Zimbra usually have a security team watching CISA’s KEV catalog and a patch cadence measured in days. A small business running Zimbra on its own VPS because it wanted control over its own email, rather than paying for a hosted inbox, often has neither. That gap is exactly where this vulnerability does its damage: the timeline shows scanning tools probing for the injection path within a week of the July patch shipping, public disclosure a month later, and Microsoft’s full writeup landing at the end of September, about ten weeks after a fix already existed.
Every day in that window is a day an unpatched, internet-facing Zimbra instance sat exposed to a flaw with a public exploit path and no authentication barrier at all.
The practical first move, patching to Zimbra 10.1.20 or later since that’s the version carrying the fix, isn’t the only lever available. If upgrading isn’t immediately possible, uninstalling the zimbra-snmp package or disabling SNMP notifications closes the specific path this flaw uses, and restricting SNMP and SMTP access at the firewall level to only the IPs that genuinely need it, rather than the open internet, shrinks the attack surface regardless of patch status. None of these are exotic; they’re the kind of SNMP-hygiene steps that get skipped specifically because SNMP feels like a background utility nobody configured on purpose.
How to check if your server was exposed
Three things are worth checking even if the server has since been patched. First, look for unexpected files in the Jetty webroot (commonly under /opt/zimbra/jetty/webapps/zimbra/), since a JSP file nobody on the team deployed is the clearest sign of compromise. Second, check the crontab for every service account and review systemd units for anything unfamiliar; attackers used both for persistence specifically because they’re easy to overlook.
Third, if SNMP was ever enabled on an internet-facing instance between the July patch and whenever the server was actually updated, rotating the three secrets listed above is worth doing regardless of whether a web shell was found, because a stolen key doesn’t announce itself the way a web shell sometimes does. A fourth check worth the extra few minutes: review outbound connection logs for traffic to unfamiliar cloud-storage endpoints, since the exfiltration method Microsoft documented relies on pushing stolen data to Azure Blob Storage, and that kind of outbound transfer shows up in firewall or NetFlow logs well before anyone notices a missing mailbox.
The true cost of a compromised mail server
A web shell on a mail server is expensive in ways that don’t show up until weeks later. Mailbox compromise frequently leads to the server’s outbound IP getting flagged by spam blocklists once attackers use it to send spam or phishing from compromised accounts, and getting an IP removed from a blocklist like Spamhaus can take days even after the underlying problem is fixed, during which legitimate mail from that domain bounces or lands in spam folders for every recipient.
If customer or employee data sat in any of the exfiltrated mailboxes, a breach-notification obligation may follow under state data-breach laws, or under GDPR for businesses serving EU customers, regardless of company size. None of that shows up in a CVSS score, but it’s the part of this incident that actually costs a small business money and reputation well after the web shell itself gets removed.
What self-hosting email means for patch management
This isn’t an argument against running your own mail server. Plenty of businesses have good reasons: data residency requirements, integration with internal tools, or simply not wanting a third party reading metadata about who they email. But self-hosting moves the patching burden entirely onto whoever manages that VPS, and a flaw like this one shows what that burden looks like in practice: an obscure, rarely-touched feature flag turning into full mailbox compromise, discovered by an outside researcher months after the fix already shipped. Anyone weighing that tradeoff should go in with a real patch-monitoring habit already in place, not add one after the first incident.
For businesses that would rather not own that risk at all, a VPS hosting plan with a managed patching option, or a hosted mail service instead of a self-managed one, removes this specific failure mode entirely.
Lessons learned from CVE-2026-73570
CVE-2026-73570 fits a pattern that’s shown up repeatedly across 2026: a flaw in an optional feature, in a system that’s internet-facing by design, that requires zero authentication to trigger. That combination is consistently the fastest from “patch released” to “exploited in the wild” of any vulnerability class, because it removes the one step, getting valid credentials first, that slows down most other attack paths. The Docker-host scanning campaign AllCloudHost covered previously followed the same shape: an exposed, unauthenticated service, scanned continuously, compromised the moment it’s reachable and vulnerable.
If there’s one habit worth taking from this incident beyond patching Zimbra itself, it’s auditing every internet-facing service for exactly this profile: optional features turned on, no authentication required, and treating anything that matches as a priority patch target the day a fix ships, not the week a researcher writes it up.