274 Mail Servers Down as CVE-2026-73570 Fuels Zimbra SNMP Exploitation Wave
CVE-2026-73570, a command injection flaw in Zimbra Collaboration Suite before 10.1.20, lets unauthenticated attackers run commands on servers with SNMP notifications enabled.
Summary
- First seen
- July 28, 2026
- Malware
- Chopper, Godzilla Web Shell, CoinMiner, Looptik, Zimdown2, Zimclient2
- Affected products
- Zimbra Collaboration Suite (ZCS) before 10.1.20
- Targeted regions
- Worldwide
A single malicious email request is enough to give attackers full control of a Zimbra mail server. CVE-2026-73570 is a high-severity command injection flaw in Zimbra Collaboration Suite versions before 10.1.20, and it lets anyone run commands on servers with SNMP notifications turned on, without logging in. A fix came out on July 20, 2026, but attackers began scanning for vulnerable servers within eight days. More than 274 servers were breached and loaded with web shells, cryptominers, and backdoors, and attackers stole emails and credentials along the way. Update to version 10.1.20 right away, and because patching will not remove an attacker who is already inside, also check exposed servers for signs of a breach.
Vulnerability Details
CVE-2026-73570 is a high-severity OS command injection vulnerability in Zimbra Collaboration Suite (ZCS) versions before 10.1.20. It affects only servers with the optional SNMP monitoring package installed and SNMP notifications enabled, which is not the default setup. An attacker needs no login or user interaction and can exploit the flaw remotely by sending a specially crafted SMTP request to the mail server.
The flaw exists because the server does not properly clean input while processing SNMP notifications. Zimbra's log-monitoring service takes a value from the attacker's request and inserts it directly into a system command used to send SNMP alerts. By adding special shell characters, the attacker breaks out of that command and runs their own commands with the privileges of the Zimbra service account.
After gaining access, attackers installed Chopper and Godzilla web shells, the Zimdown2 installer, the Zimclient2 remote access agent, a CoinMiner cryptominer, and the Looptik privilege escalation toolkit. They raised their privileges, kept long-term access through disguised system services and scheduled tasks, and ran a memory-only agent that takes commands from a blockchain contract. They also stole Zimbra service credentials to reach the mail database and directory, moved to other servers in the cluster, and sent packaged mailbox data to attacker-controlled cloud storage. The attackers have not been identified.
The vulnerability has a CVSS v3.1 score of 8.9. The non-default configuration requirement lowers the score slightly, but it stays high because exploitation is remote, requires no authentication, and can fully compromise the server. Successful attacks expose email, credentials, and the wider network to espionage, business email compromise, regulatory penalties, and costly incident response. Because attackers set up persistent backdoors, patching alone will not remove an attacker who is already inside.
The fix was released on July 20, 2026. Scanning for vulnerable servers began on July 28, before the flaw was publicly disclosed on August 13, 2026. Active exploitation was reported in mid-August, and the flaw was added to the Known Exploited Vulnerabilities (KEV) catalog on August 21, 2026, with a remediation deadline of August 24, 2026. At least 274 of more than 12,100 internet-exposed Zimbra servers were found compromised, and about 8,200 were still unpatched. Attacks began after a patch was available, so the flaw is not a zero-day, but it was exploited before most defenders knew about it.
Affected products and CVEs
| CVE ID | Affected products | Affected CPE | CWE ID |
|---|---|---|---|
| CVE-2026-73570 | Synacor Zimbra Collaboration Suite (ZCS) before 10.1.20 | cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* | CWE-78 |
Recommendations
- 01Upgrade Zimbra ImmediatelyUpgrade every Zimbra Collaboration Suite instance to version 10.1.20 or later without delay, following the vendor patch installation guidance. Prioritize internet-facing mail servers and all mailbox, MTA, and proxy nodes in multi-server clusters, since exploitation has been observed at scale and CISA set a three-day remediation deadline for federal agencies.
- 02Remove or Disable the SNMP Attack SurfaceWhere an immediate upgrade is not possible, uninstall the optional
zimbra-snmppackage or disable SNMP notifications to close the vulnerable code path. Restrict SNMP and SMTP access to trusted hosts at the network perimeter until the upgrade is complete, and re-verify the configuration after any maintenance activity. - 03Treat Exposed Servers as Potentially CompromisedPatching does not remove web shells, backdoors, or persistence that may already be in place. Any server that ran a vulnerable configuration while exposed to the internet should be handled as an incident response case, and reverse-shell or suspicious process alerts on internet-facing mail servers should be escalated as priority incidents.
- 04Hunt for Web Shells and Malicious FilesInspect
/opt/zimbra/jetty/webapps/,/opt/zimbra/jetty_base/webapps/, mailboxd webapp directories, the/work/zimbra/jsp/servlet work directory, and/tmp/for new or modified .jsp and .jspx files and for files created by the zimbra user within the past 30 days. Review/var/log/zimbra.logfor unexpected service restarts and look for masqueraded files such as.kworker_sys,.lpe_core,/usr/sbin/_chronyd, and/dev/shm/systemd-resolved. - 05Review Persistence MechanismsAudit
/etc/systemd/system/for unexpected units such aszimlog.service,chronyd-helper.service, andsyslog_init.service, and check for unexpected ownership or timestamp changes. Examine/etc/cron.d/,/etc/init.d/,/etc/profile,/etc/bashrc, authorized_keys files,/etc/pam.d/sudo, and/etc/sudoers.d/for unauthorized modifications, and remove any unauthorized administrator accounts. - 06Rotate Zimbra Secrets and CredentialsRotate Zimbra authentication secrets, including the service credentials stored in
localconfig.xml, LDAP and MySQL passwords, the Zimbra SSH identity used between cluster nodes, and TLS certificates and keys present on the server. Force password resets for user and administrator accounts where mailbox or credential exposure is suspected.
Indicators of Compromise (IoCs)
| Type | Value |
|---|---|
| SHA256 | dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d 6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244 bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159 65a7576c389326b6cdf9c993d0be6e5d50fed9655d1cdf2a3a50f2c21c8ec435 22ef852f6ebc39ee71235b90648b4b200b385c47d25c79545986493f8c70db69 518fe65dd349180191d9b258ab24876aaed6613cd657d0b626d1fc24e03a22b6 |
| IPv4:Port | 117[.]107[.]25[.]243[:]7071 192[.]255[.]193[.]111[:]9004 45[.]32[.]30[.]235[:]8081 45[.]32[.]30[.]235[:]8080 193[.]42[.]40[.]135[:]443 3[.]209[.]137[.]175[:]443 |
| Domains | transzimbra[.]linkpc[.]net tls[.]psk1zim[.]abrdns[.]com bypass[.]eu[.]org |
| URLs | psk1zim[.]abrdns[.]com/agentws wslogzimbra[.]linkpc[.]net/wsstat mexico-cashpay-test[.]s3[.]dualstack[.]mx-central1[.]amazonaws[.]com/pakistan/2026/aliyun_update[.]tar[.]gz wsweb03[.]blob[.]core[.]windows[.]net/log/windows[.]log |
| Filenames | de.sh agent.sh agent2.sh zimdown2 zimclient2 build_amd64 .kworker_sys .lpe_core aliyun_update.tar.gz five.ico zimlog.service chronyd-helper.service syslog_init.service |
| File Path | /usr/sbin/_chronyd /dev/shm/systemd-resolved /etc/systemd/system/zimlog.service /etc/sudoers.d/81_metric /opt/zimbra/final.tar.gz /tmp/zimbra_dump_YYYYMMDD_HHMMSS/ /tmp/s |
| Base Contract Address | 0x25bdA7Feb3553995AD68a9A8Ed8c731b73a71586 |
MITRE ATT&CK TTPs
References & Patch Links
Patch links
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.20#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.0/patch_installation
References
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)