Critical Zimbra RCE Flaw CVE-2022-27925 Actively Exploited

Key Takeaways

• Attackers are actively exploiting CVE-2026-73570, a critical Remote Code Execution (RCE) vulnerability in Zimbra mail servers.
• The flaw allows unauthenticated command injection through specially crafted emails, requiring no user interaction.
• Impacted organizations span various regions and industries, with attackers deploying web shells, stealing credentials, and establishing persistent access.
• The vulnerability affects Zimbra installations with the optional zimbra-snmp package enabled and SNMP notifications active.
• A patch is available in Zimbra 10.1.20 and later versions.

Cybersecurity researchers have identified active exploitation of a severe Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-73570, affecting internet-facing Zimbra mail servers. This critical flaw enables attackers to execute arbitrary commands on vulnerable servers by sending specially crafted emails, without requiring any authentication or user interaction.

Microsoft Threat Intelligence has been tracking these attacks, observing compromised organizations across diverse geographical locations and industry sectors. The attackers demonstrated a sophisticated approach, combining automated payload delivery with manual “hands-on keyboard” operations post-exploitation.

Understanding the Vulnerability: CVE-2026-73570

The core of the issue lies in a command injection vulnerability within Zimbra’s SNMP notification feature. This flaw is present in systems where the optional zimbra-snmp package is installed and SNMP notifications are activated. When a crafted SMTP request is processed, shell characters provided by the attacker can bypass validation and reach the SNMP notification handler. Subsequently, if a service-state change triggers monitoring, the swatchdog process inadvertently incorporates this malicious input into a snmptrap command, executing it with the privileges of the zimbra service account. This transforms a routine monitoring component into a critical attack vector, as detailed in a detailed report by Microsoft.

Crucially, this vulnerability requires no password, valid account, or any user interaction, making exposed servers highly susceptible. This unauthenticated nature elevates the risk significantly for administrators overseeing public mail infrastructure, underscoring the urgency of addressing this flaw.

Attack Chain and Post-Exploitation Activity

Microsoft observed initial reconnaissance efforts by threat actors between July 28 and August 7, shortly after Zimbra version 10.1.20 was released on July 20, but prior to the public disclosure of the vulnerability on August 13. Attackers utilized lightweight HTTP, DNS, and ICMP callbacks to verify command execution and assess reachability to the server’s webroot before deploying more potent malware.

Once initial access was achieved, attackers manipulated web directory permissions, reassembled compressed payload fragments, and deployed JSP web shells into public application folders. They then systematically removed the staged components and copied additional web shells to other mailbox nodes, a technique consistent with persistent email server web shell deployments observed in previous incidents. This multi-stage approach allowed them to establish a robust foothold and expand their presence within the compromised environment.

Further post-exploitation activities included using common command-line tools to download additional content, initiating background processes, and establishing interactive reverse shells. In one instance, a named pipe facilitated a local shell connection to an encrypted OpenSSL session, enabling the attackers to issue commands and receive output securely. The attackers then proceeded to map mailbox and mail-transfer nodes, leveraging Zimbra’s existing SSH identity with rsync to propagate their tools across trusted cluster systems, thereby extending their access beyond the initially compromised server.

Targeting Service Credentials and Data Exfiltration

The attackers focused on obtaining critical service secrets rather than just individual user credentials. They executed Zimbra configuration and directory queries to harvest credentials for essential services like LDAP, MySQL, and Postfix. Additionally, they targeted pre-authentication keys, token-signing materials, and two-factor authentication secrets. These highly sensitive keys could grant extensive access beyond single user mailboxes.

Investigators also discovered a Zimbra-specific implant designed to read local configuration files, export database tables, and stage certificates, private keys, and directory data for exfiltration. While not all attempted transfers were confirmed, the intent to exfiltrate sensitive data was clear. On one specific server, attackers archived mailbox backup data into a local file and attempted to upload it to cloud storage.

Evidence also pointed to a privilege escalation path that involved manipulating a writable log location and PAM configuration, ultimately granting the zimbra account passwordless administrative access. Furthermore, researchers uncovered a disguised system service located outside typical Zimbra directories, configured to enable at boot with misleading timestamps. Other persistence mechanisms included scheduled tasks, startup files, SSH keys, and local accounts, highlighting the need for defenders to meticulously inspect all potential avenues for persistence.

What You Should Do

• Immediately Update: Upgrade all Zimbra installations to version 10.1.20 or later without delay.
• Mitigation (if immediate upgrade is not possible):
  • Remove the zimbra-snmp package.
  • Disable SNMP notifications.
  • Restrict SNMP and SMTP access to only trusted hosts.
• Review and Monitor: Scrutinize monitoring settings and logs for any unusual command activity. Treat any reverse-shell alert on an internet-facing mail server as a high-priority incident.
• Forensic Investigation:
  • Inspect every mailbox node for unexpected JSP files, newly generated servlet artifacts, and recent permission changes.
  • Rotate all Zimbra pre-authentication keys.
  • Review system services for suspicious ownership, enablement status, or timestamp modifications.
  • Preserve all relevant logs before initiating any containment measures.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.