{"id":3277,"date":"2026-09-30T17:57:56","date_gmt":"2026-09-30T17:57:56","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3277"},"modified":"2026-09-30T17:57:56","modified_gmt":"2026-09-30T17:57:56","slug":"attackers-exploit-zimbra-flaw-to-deploy-web-shells-and-harvest-authentication-secrets","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3277","title":{"rendered":"Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets"},"content":{"rendered":"
\n
<\/a><\/div>\n

Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team.<\/p>\n

The attack exploits CVE-2026-73570<\/strong> (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol (SNMP) notifications are enabled and the optional zimbra-snmp package is installed.<\/p>\n

Exploitation of CVE-2026-73570 can be triggered by a specially crafted SMTP request (i.e., email against exposed Zimbra servers without requiring authentication or user interaction. The vulnerability was patched by Zimbra in July 2026 with the release of version 10.1.20.<\/p>\n

\u00abFollowing successful exploitation, observed activity included deployment of JSP web shells and reverse shells, privilege escalation, persistent remote-access tooling, and memory-backed execution,\u00bb the tech giant said<\/a>. \u00abThreat actors also accessed email and collected authentication and mailbox data, with archive creation and subsequent transfer activity observed.\u00bb<\/p>\n

Microsoft said it observed affected organizations in more than one region and industry, although not every host exhibited every stage of the attack chain. It’s currently not known who is behind the attacks.<\/p>\n

Details of active exploitation of CVE-2026-73570 were first highlighted by the Polish Computer Emergency Response Team (CERT Polska) in August 2026, with the agency urging users to review the \u00ab\/var\/log\/zimbra.log\u00bb file for suspicious Zimbra service restarts, and look for files created in temporary and Zimbra \u00abwebapps\u00bb directories.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Later that month, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) officially added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies apply the fixes by August 24, 2026.<\/p>\n

<\/p>\n

Based on telemetry data, the attack activity documented by Microsoft was identified \u00abduring the interval\u00bb between July 20, 2026, when Zimbra version 10.1.20 was released, and August 13, 2026, when the flaw was publicly disclosed.<\/p>\n

Specifically, between July 28 and August 7, 2026, two distinct out-of-band scanning tools were found probing the injection path to validate command execution without delivering a follow-on payload.<\/p>\n

The attackers then abused this initial access pathway to run commands as the \u00abzimbra\u00bb service account and deploy multiple JSP web shells across Jetty and mailboxd application paths for redundancy, as well as download and execute malicious payloads directly through wget or curl, and establish interactive reverse shells.<\/p>\n

\"\"<\/a><\/div>\n

\u00abOther execution chains used cron, systemd, or memfd_create to maintain recurring or memory-backed execution,\u00bb Microsoft said. \u00abIn some cases, attackers temporarily enabled write access to a public directory to deploy the web shell and then restored the directory permissions, limiting the visibility of the change during basic permission checks.\u00bb<\/p>\n

Some of the subsequent steps undertaken by the threat actor are listed below –<\/p>\n