Zimbra, again: unauthenticated command injection over SMTP

CISA added CVE-2026-73570 to the KEV catalogue on 21 August 2026 with a remediation due date of 24 August — three days.

Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Three properties in that sentence, and each one removes a defence you might otherwise have been relying on.

Unauthenticated, over SMTP, as a service account

Unauthenticated means credential hygiene does not help. No password policy, no MFA prompt, no session to steal. The exploit path begins before any identity is established.

Over SMTP means the attack surface is the one part of the system that must accept connections from people you have never met. A web console can be put behind a VPN. A mail server that refuses inbound SMTP from the internet has stopped being a mail server. This is the distinction worth internalising: for most applications, "restrict access to trusted networks" is real mitigation; for inbound mail it is a category error.

As the zimbra user means the attacker lands as the account that owns the mail store. Not root — but root is rarely the goal. The account that can read every mailbox in the organisation is a perfectly good outcome for anyone whose objective is correspondence.

Why this keeps happening here

Zimbra has appeared in the KEV catalogue repeatedly over the past several years. That track record is worth reading correctly: it is not evidence that Zimbra is uniquely badly written, but that it is a large, internet-exposed, multi-component application that is widely deployed by organisations without dedicated mail administrators — and it is therefore heavily researched by people on both sides.

Groupware sits in an awkward position. It is infrastructure, so it is expected to run untouched for years. It is also an application with a broad feature surface, so it accrues vulnerabilities at application pace. Those two expectations are incompatible, and the gap between them is where the exploitation happens.

What to look for

The zimbra account executing a shell. This is the highest-value signal and the cheapest to implement. The mail transfer path legitimately invokes a known, small set of binaries. sh, bash, python, perl, curl and wget are generally not among them in normal operation. Alert on the zimbra user as the parent of an interactive shell.

Writes into web-accessible directories. Command execution on a mail server is typically followed by dropping a webshell into whatever path the web component serves, because a shell obtained through SMTP is awkward to use twice. New or modified files under Zimbra's web roots are worth treating as high signal.

Outbound connections from the mail host to anywhere unusual. A mail server talks to a lot of the internet on port 25, which makes egress monitoring noisy — but it should not be making HTTP requests to arbitrary hosts, and it should not be initiating connections on unusual ports at all.

SMTP transactions that fail strangely. Injection attempts frequently leave malformed transactions in the MTA logs before the successful one. Retrospective review of protocol errors around the time of a suspected compromise is often where the first artefact turns up.

Remediation

Patch to a fixed release. The CISA due date passed on 24 August, which means that in CISA's assessment this was already being used against federal networks before most people had read the advisory.

If the instance was exposed and unpatched during that window, patching is not the end of the work — a webshell dropped before the fix is unaffected by it. Check the web roots, check the hooks, check crontab -l for the zimbra user, and check for SSH keys that nobody remembers adding.

Source: NVD — CVE-2026-73570 · CISA Known Exploited Vulnerabilities catalogue, added 21 August 2026.

This is analysis of a public advisory. It is not an incident report, and no intrusion data informed it — the detection guidance above is derived from the documented mechanism, not from observed activity.